fix(rest/nodejs): deliver the order object as the webhook body

[vishkaty]

Mirrors #140 (now merged) on the Node.js side.

What

The orderEvent webhook body must be an order object (rest.openapi.json →
{"$ref": "order"}), but the Node.js server posted a custom envelope
{ event_type, checkout_id, order } (rest/nodejs/src/api/checkout.ts), and
posted it even when there was no order.

This posts the order object as the JSON body, carries the event type in an
X-Event-Type header, and skips delivery when there is no order — identical to
the fix merged for the Python server in #140.

Test

Adds rest/nodejs/test/webhook.test.ts (node:test, no new deps): stubs the
outbound fetch to capture the delivered request and asserts the body is the
bare order (all required order fields, no event_type/nested-order envelope
keys), the event type is in X-Event-Type, and there is no delivery when the
checkout has no order. Fails on the old envelope, passes on the fix.

Verification

• npm ci clean, npm run build (tsc) 0 errors, npm test 7 passed (5
  existing + 2 new), pre-commit clean.

[damaz91]

The changes look good and align the Node.js implementation with the Python fix in #140 by delivering the bare order object as the webhook body and carrying the event type in the X-Event-Type header. Tests look good and pass.

Note: The current UCP specification requires Webhook-Timestamp and Webhook-Id headers for the orderEvent webhook. Neither the Python nor this Node.js implementation currently sends these headers. Opened a separate issue to track adding these spec-mandated headers to both implementations (#147).