Qscore credit report ready

A Qscore credit report purchased with POST /v1/qscore/reports finished generating successfully. The payload carries the report identity, the resulting score/band and the public verify_code (shareable with the subject as proof of authenticity at GET /verify/qscore/{code}). If the generation fails the report shows status: failed and no event is emitted. The event is also emitted when the purchased report was already available for the subject (idempotent reuse). The same event fires for a SELF report generated by the account holder with POST /v1/qscore/my-report; in that case the payload adds purpose: "self_access" (absent for purchased reports).

Every delivery includes X-Webhook-Event, X-Webhook-Event-ID, X-Webhook-Delivery-ID, X-Webhook-Timestamp and X-Webhook-Signature = hex(HMAC-SHA256(secret, timestamp + "." + body)). Respond 2xx; up to 5 attempts with incremental backoff.