feat(webhook): finalize provider ingress parity

internal/handler/webhook/webhook_lookup_test.go

@@ -792,6 +792,45 @@ func TestInstagramWebhookEventsVerifySignatureAndResolveInbox(t *testing.T) {
 	assertPersistedMessage(t, db, inbox.ID, "mid-1", "hello")
 }
 
+func TestInstagramWebhookRejectsMissingSignature(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	db := newWebhookLookupTestDB(t)
+	inbox := seedWebhookInbox(t, db, "instagram")
+	channel := channelmodel.ChannelInstagram{
+		AccountID:                  1,
+		InboxID:                    inbox.ID,
+		InstagramAccountID:         "ig-123",
+		InstagramBusinessAccountID: "ig-business-123",
+		PageAccessToken:            "page-token",
+		ConnectedFBPageID:          "page-123",
+		InstagramAccountName:       "gochat",
+	}
+	if err := db.Create(&channel).Error; err != nil {
+		t.Fatalf("create instagram channel: %v", err)
+	}
+	t.Setenv("INSTAGRAM_APP_SECRET", "ig-secret")
+
+	body := []byte(`{"object":"instagram","entry":[{"id":"ig-123","time":1,"messaging":[{"sender":{"id":"user-1"},"recipient":{"id":"ig-123"},"timestamp":1,"message":{"mid":"mid-missing-sig","text":"hello"}}]}]}`)
+	h := NewFacebookWebhookHandler(nil, nil, db)
+	r := gin.New()
+	r.POST("/webhooks/instagram", h.HandleInstagramWebhook)
+	req := httptest.NewRequest(http.MethodPost, "/webhooks/instagram", bytes.NewReader(body))
+	w := httptest.NewRecorder()
+
+	r.ServeHTTP(w, req)
+
+	if w.Code != http.StatusUnauthorized {
+		t.Fatalf("expected 401, got %d body=%s", w.Code, w.Body.String())
+	}
+	var count int64
+	if err := db.Model(&model.Message{}).Where("inbox_id = ? AND source_id = ?", inbox.ID, "mid-missing-sig").Count(&count).Error; err != nil {
+		t.Fatalf("count message: %v", err)
+	}
+	if count != 0 {
+		t.Fatalf("expected no persisted message, got %d", count)
+	}
+}
+
 func assertPersistedMessage(t *testing.T, db *gorm.DB, inboxID uint, sourceID string, content string) model.Message {
 	t.Helper()
 	var message model.Message