Resolve a validated session from a webhook event. Each provider knows how to extract/fetch session data from its own event structure, so the webhook handler stays provider-agnostic.