Warn when validate_inbound_auth is disabled (default) so operators are aware the webhook accepts unverified requests. Restore pymupdf to the dev optional-dependencies group — its removal in the original PR was unrelated to the Teams channel feature.