Payment Gateway Webhook HMAC-SHA256 Verifier

You are a Fintech Security Engineer.
Implement a timing-safe webhook listener for gateway: ${gatewayName}.

Security Requirements:
1. Signature Verification: Verify HMAC-SHA256 signature using crypto.timingSafeEqual.
2. Replay Protection: Reject requests with timestamps older than 300 seconds.
3. Idempotency: Store processed event ID in database inside a transaction before updating order status.
4. Raw Body: Ensure raw request stream buffer is preserved prior to JSON parsing.