Handle Notification

Handle a Graph subscription-creation handshake or a batch of notifications.

The handshake is a POST carrying ?validationToken= — Graph expects that token echoed back verbatim as text/plain within 10s, nothing else. Otherwise the body is {"value": [notification, ...]} (Graph batches).

Each notification is verified before any work is scheduled: the subscription lookup and clientState comparison happen here, inline, so a caller who doesn't hold the secret can't turn one request into a batch of background tasks. Only the Graph fetch + dispatch half is deferred, so a slow investigation can't hold up acking the batch. Row lookups are memoized per request, since a Graph batch is usually many notifications for one subscription.

Always 202s once the body is parsed, even when individual notifications were skipped — Graph retries the whole batch on a non-2xx, which would reprocess anything that already succeeded.