Update nextjs-signature-verification setup

[pfferrari]

Closes commercelayer/issues-app/issues/714

Update: webhooks/nextjs-signature-verification

Modernized the example and aligned it with the conventions of the recently updated
cms/nextjs-contentful-store project. Pages Router is kept.

Dependencies

• Next.js 14.2.5 → 16.3.4, React 18.3.1 → 19.2.8
• TypeScript 5.5.4 → 5.9.3, @types/* bumped, @types/react-dom added
• Lockfile regenerated with pnpm

Tooling

• Replaced .eslintrc.json with a flat eslint.config.mjs (eslint-config-next 16 + eslint-config-prettier)
• Added Prettier (.prettierrc, .prettierignore), .npmrc, pnpm-workspace.yaml and a project-level .gitignore
• next.config.js → next.config.mjs (ESM)
• Modernized tsconfig.json: es2022 target/lib, moduleResolution: bundler, jsx: react-jsx, noUnusedLocals/noUnusedParameters
• package.json: full metadata (repository, homepage, keywords, bugs), engines: node >=22, new typecheck, format and lint:fix scripts, preinstall guard for pnpm

Code

• Renamed pages/_app.page.tsx → pages/_app.tsx — with the .page.tsx extension Next never picked the file up, so globals.css was never applied
• Rewrote pages/api/verify.ts:
  • async/await raw-body read instead of manually wrapping stream event listeners in a Promise
  • constant-time signature comparison via timingSafeEqual instead of ===
  • 405 with an Allow: POST header for non-POST requests
  • 500 when CL_SHARED_SECRET is missing
  • distinct handling for a missing signature header vs. an invalid signature
• pages/index.tsx: dropped the unused Image import (would break the typecheck under noUnusedLocals) and replaced the leftover Create Next App title
• Trimmed the unused create-next-app classes from Home.module.css, added dark-mode support, removed public/vercel.svg

Documentation

• README: requirements section, corrected step order (the secret used to be set after starting the server), endpoint response table, a local openssl test snippet, and a scripts table

Verification

• typecheck, lint, prettier --check and build all clean
• Endpoint tested against the dev server with a real shared secret:
  • valid signature → 200
  • valid signature with a tampered payload → 401 (confirms the raw body reaches the HMAC untouched)
  • signature computed with the wrong secret → 401
  • missing signature header → 401
  • GET instead of POST → 405 with Allow: POST
  • home page → 200, now loading the global stylesheet

Open point

• next dev auto-generates AGENTS.md and CLAUDE.md in the project folder (Next 16 rewrites them on every start). They are committed in cms/nextjs-contentful-store; decide whether to commit them here too or disable them with agentRules: false.

Checklist (general changes)

• Make sure your changes are tested (stories and/or unit, integration, or end-to-end tests).
• Make sure to add/update documentation regarding your changes.
• You are NOT deprecating/removing a feature.

[netlify]

✅ Deploy Preview for cl-nextjs-contentful-store canceled.

Name	Link
🔨 Latest commit	c8f93b6
🔍 Latest deploy log	https://app.netlify.com/projects/cl-nextjs-contentful-store/deploys/6aa26a6817c0cf000828db31