refactor(middlewares): remove VerifyHmacSignature middleware

This change removes the VerifyHmacSignature middleware and its alias from the configuration.

bootstrap/middlewares.php

@@ -3,10 +3,8 @@
 declare(strict_types=1);
 
 use Illuminate\Foundation\Configuration\Middleware;
-use Infra\Http\Middleware\VerifyHmacSignature;
 
 return function (Middleware $middleware): void {
     $middleware->alias([
-        'auth.hmac' => VerifyHmacSignature::class,
     ]);
 };

src/Infra/Http/Middleware/VerifyHmacSignature.php

@@ -1,62 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Infra\Http\Middleware;
-
-use Closure;
-use Illuminate\Http\Request;
-use Infra\Database\Models\ApiClient;
-use Symfony\Component\HttpFoundation\Response;
-
-final class VerifyHmacSignature
-{
-    private const TIMESTAMP_TOLERANCE_SECONDS = 300;
-
-    /**
-     * @param  \Closure(\Illuminate\Http\Request): \Symfony\Component\HttpFoundation\Response  $next
-     */
-    public function handle(Request $request, Closure $next): Response
-    {
-        $clientId  = $request->header('X-Client-Id');
-        $timestamp = (int) $request->header('X-Timestamp');
-        $signature = $request->header('X-Signature');
-
-        if (! $clientId || ! $timestamp || ! $signature) {
-            return response()->json(['error' => 'Headers d\'authentification manquants.'], 401);
-        }
-
-        if (! is_string($clientId) || ! is_string($signature)) {
-            return response()->json(['error' => 'Headers d\'authentification invalides.'], 401);
-        }
-
-        if (abs(time() - $timestamp) > self::TIMESTAMP_TOLERANCE_SECONDS) {
-            return response()->json(['error' => 'Requête expirée (horodatage invalide).'], 401);
-        }
-
-        $client = ApiClient::query()->where('client_id', $clientId)
-            ->where('is_active', true)
-            ->first();
-
-        if (! $client) {
-            return response()->json(['error' => 'Client non identifié ou inactif.'], 401);
-        }
-
-        $payload = implode('|', [
-            strtoupper($request->method()),
-            $request->getRequestUri(),
-            $timestamp,
-            $request->getContent(),
-        ]);
-
-        $expectedSignature = hash_hmac('sha256', $payload, $client->secret);
-
-        if (! hash_equals($expectedSignature, $signature)) {
-            return response()->json(['error' => 'Signature HMAC invalide.'], 401);
-        }
-
-        $request->setUserResolver(fn () => $client);
-
-        return $next($request);
-    }
-}