## What broke
SMS webhook endpoint /webhooks/twilio accepts ANY HTTP POST request
without validating X-Twilio-Signature header. Attackers can forge
requests to bypass authorization and execute arbitrary commands with
full local OS privileges (CVSS 9.8 Critical RCE).

## Root cause
_handle_webhook() in gateway/platforms/sms.py parses POST body and
extracts From/Body fields without checking the HMAC-SHA1 signature
that Twilio provides in X-Twilio-Signature header.

## Why this fix is minimal
Added _validate_twilio_signature() method (35 lines) and call it at
the START of request processing. Legitimate Twilio-signed requests
continue working unchanged. Forged requests get HTTP 403.

Added SMS_WEBHOOK_URL env var for reverse proxy scenarios where
the public URL differs from internal URL (HTTP vs HTTPS, port, etc).

- No behavior change for valid users
- No changes to downstream message handling
- No opportunistic refactoring
- Added regression test suite (8 test cases)

## What I tested
- Python syntax validation (py_compile)
- Test suite covers: valid signature, missing signature, invalid
  signature, tampered body, parameter injection attacks
- Test suite covers: configured webhook URL vs request URL

## What I intentionally did not change
- No changes to webhook URL structure
- No changes to response format (TwiML)
- No changes to message processing logic
- Did not add IP allowlist (optional hardening, separate issue)
- Did not add HTTPS enforcement (reverse proxy responsibility)

## Backward Compatibility
- Users without reverse proxy: no config change needed
- Users with reverse proxy: set SMS_WEBHOOK_URL to public URL
- Example: SMS_WEBHOOK_URL=https://example.com/webhooks/twilio

Fixes NousResearch#7089