fix(api): replace crypto-js with Web Crypto API

[ohld]

Problem

@ton-pay/api breaks Next.js builds with hundreds of "Module not found" errors (cipher-core, aes, blowfish). The package bundles all 37 crypto-js sub-modules (228KB) via noExternal: ['crypto-js'] in tsup — but only uses HmacSHA256 for webhook signature verification.

Hit this while building a TMA with TON payments on Next.js. Had to drop @ton-pay/api entirely and use raw tonConnectUI.sendTransaction() as a workaround.

Fix

Replaced crypto-js with the Web Crypto API (crypto.subtle.importKey + crypto.subtle.sign). This is:

• Zero dependencies — Web Crypto is built into all browsers and Node.js 18+
• ~2KB vs 228KB — 99% bundle size reduction
• Works everywhere — no webpack/Turbopack resolution issues

The tradeoff: verifySignature is now async (returns Promise<boolean>). Since it's a server-side webhook verification function, this should be fine — webhook handlers are already async.

Changes

• packages/api/src/utils/verify-signature.ts — replaced crypto-js import with Web Crypto API
• packages/api/package.json — removed crypto-js and @types/crypto-js dependencies
• packages/api/tsup.config.ts — removed noExternal: ['crypto-js']

Repro (before this fix)

1. npx create-next-app@latest myapp --typescript --app
2. npm install @ton-pay/api
3. Import createTonPayTransfer in any file
4. npm run build → hundreds of "Module not found: Can't resolve './cipher-core'" errors