DonationWebhookSecrets

Manages encrypted storage of per-platform webhook verification credentials for non-Stripe Listener Support donation platforms (Ko-fi, PayPal, Buy Me a Coffee). Each secret is encrypted at rest using the same libsodium Crypto layer as Stripe API keys — plaintext is never written to wp_options. Unsupported platform slugs are hard-rejected by all methods.

Platform slugs are normalized before storage and lookup — Ko-Fi, ko_fi, kofi, and KoFi all resolve to the canonical kofi slug.