Document n8n raw body signature validation

docs/ocsentinel-n8n-contract.md

@@ -36,7 +36,7 @@ For the isolated development environment only, HTTP is permitted at
 `http://172.16.41.197:5678/webhook/ocsentinel-ingest`. Do not reuse this URL,
 the development shared secret, or a disabled-TLS configuration in production.
 
-1. `Webhook`: accept `POST` on the configured private URL.
+1. `Webhook`: accept `POST` on the configured private URL and enable **Raw Body**.
 2. `Code`: reject a request if `X-ATN-Device`, `X-ATN-Timestamp`,
    `X-ATN-Nonce`, `X-ATN-Version`, `X-ATN-Payload-SHA256`, or
    `X-ATN-Signature` is missing; reject timestamps outside five minutes.
@@ -49,6 +49,11 @@ the development shared secret, or a disabled-TLS configuration in production.
 <device>\n<timestamp>\n<nonce>\n<version>\n<payload-sha256>
 ```
 
+In the current n8n Webhook node, the raw bytes are exposed as Base64 at
+`$binary.data.data`. Decode this value before calculating the payload hash.
+Do not hash `JSON.stringify($json.body)`: parsing and reserializing JSON
+changes whitespace and can change the signed byte sequence.
+
 4. `Postgres`: insert the nonce into `ocsentinel.ingest_nonce` with a short
    expiry. If it already exists, return `409` and do not process the report.
 5. `Postgres`: upsert the device, insert a row in `ocsentinel.scan_report`,