refactor: PSK 签名改为 METHOD:path:timestamp 格式

- 签名内容不再包含 email，email 仅作审计
- 改用 METHOD:path:timestamp 防重放到不同端点
- X-Email 头改为可选
- medibot 签名: HMAC(PSK, 'POST:/api/v1/sites/x/submit:1234567890')

par-api/src/main/java/com/par/api/controller/AuthController.java

@@ -106,7 +106,8 @@ public class AuthController {
         String sig = request.getHeader("X-Medibot-Signature");
         if (ts == null || sig == null) return false;
         try {
-            return pskService.verify(email, Long.parseLong(ts), sig) != null;
+            return pskService.verify(request.getMethod(), request.getRequestURI(),
+                    Long.parseLong(ts), sig) != null;
         } catch (NumberFormatException e) {
             return false;
         }