How would you architect a secure, multi-tenant webhook delivery system that guarantees at least-once delivery?