Edge function without JWT verification

Supabase verifies the bearer token before an edge function even starts. With `verify_jwt = false` that barrier is gone: the endpoint is callable by anyone on the internet, with no account and no sign-in.

The setting almost always enters a project for a legitimate reason — a payment or mail webhook cannot send a user token. The mistake is not disabling it, but what is missing afterwards: verifying the caller yourself.

Fix: keep verification on for user-facing functions. For webhooks, verify the provider's signature inside the function (Stripe, GitHub and others send a header for this) and additionally check that the call belongs to an expected operation.