feat: add contract signing functionality

[bestony]

[github-actions]

This pull request has been translated to English for broader visibility.

Original title:
feat： 新增合同签署相关功能

Original body:

The best fix is to avoid returning the direct message of WithdrawalError to the user. Instead, we should log the exception server-side (including the message and stack trace), and return a generic error message to the client, such as "Withdrawal request could not be processed.". This prevents any sensitive implementation or debugging details from leaking to a potential attacker.

Specifically:

• In the except WithdrawalError as exc: block, replace the population of body and status with logging the exception and a more generic error response.
• Add a logging call to record the exception (with stack trace) for internal troubleshooting.
• (Re-)use the logging instance logger already present in the code.
• Do not change the status code unless desired (can leave as 400 for client error).

All changes can be made in points/webhooks.py.

---

[github-actions]

• points/webhooks.py:30-71 Webhook 默认不做任何签名/Token 校验（仅在配置了 FDD_WEBHOOK_TOKEN 时才检查，而 .env.example 默认空），任何人都可直接 POST {"signing_record_id":..., "status":"SIGNED"} 即被视为法大大回调并自动创建提现申请，存在严重未授权提现风险。建议强制校验固定 Token 或法大大签名，未通过直接拒绝，并在默认配置中要求设置。
• points/fadada.py:220-235 的 sign_with_template 仍是 NotImplemented，start_withdrawal_contract_signing 在 WITHDRAWAL_CONTRACT_SIGNING_REQUIRED=True 时会捕获后标记为失败并抛错（points/withdrawal_contracts.py:164-183），导致启用合同签署后用户永远无法提现。需要落地法大大签署调用或临时关闭该开关。
• points/fadada.py:181-218 获取 access token 后无视接口返回的 expiresIn，始终按本地固定超时时长缓存，实际有效期更短时会长期使用过期 token，导致签署请求失败直到缓存失效。建议按返回的 expiresIn（留出安全余量）设置缓存时长或在每次请求前校验过期时间。