Mint a new 32-byte hex HMAC secret for signing outbound webhook payloads.
The secret is returned in plaintext exactly once — copy it immediately
and configure your receiver before enabling the webhook.

The previous secret is immediately invalidated; any in-flight signed
payloads using the old value will fail verification on your side.

Configure your receiver to verify X-PPLUS-Signature: sha256=<hex> over the
raw request body bytes using this secret (see the Webhooks tag description
for a Node.js verification snippet).