a) you leaked your webhook secret in your code posted to the forum
2) Your nodeJS code is correct as it created hooks file, just verification failed
iii) The problem lies in your PHP code or the Apache hand off
You can test this using the Twitch CLI
I suspect the issue if you header loading, as off hand, I think PHP auto converts all header names to lowercase but you are trying to use CamelCased header names
here is a working example from my examples repository