feat: blog articles resource and webhook verifier

[alihesari]

What

• client.blog: settings (get_settings, update_settings, rotate_website_secret, test_website), keywords (list_keywords, plan_keywords, add_keyword, update_keyword, delete_keyword) and articles (list_articles, request_article, get_article, update_article, regenerate_article, publish_article, reject_article, delete_article) over /v1/blog, with BlogSettings, BlogKeyword, BlogArticle, BlogArticleFull, BlogArticleImage models and the status/target tuples.
• fopost.webhooks.verify (root export verify_webhook): raw-body HMAC check with hmac.compare_digest, timestamped signature preferred with a 300 s tolerance, body-only signature as fallback, returns the {event, data, timestamp} envelope. ArticlePublishedPayload types article.published.
• ChatAdapter.verify_webhook now delegates to the shared verifier; error codes unchanged.
• README Blog section, CHANGELOG under Unreleased.

workspaceId travels camelCase on every blog route (query on reads and per-id routes, body on the collection POST/PATCH), matching the handler.

How to verify

uv sync --group dev
uv run ruff check . && uv run ruff format --check . && uv run mypy && uv run pytest

tests/test_blog.py covers path, method, query and body for every route plus the 402 and 409 mappings; tests/test_webhooks.py covers valid timestamped, tampered body, stale timestamp and legacy body-only signatures.

Release

No version bump and no tag: releases are batched. fopost-django and fopost-fastapi need no change (they re-export the client; new namespace is additive).