Set user consent records from incoming webhook events

Incoming permission events are inconsistent or incomplete, causing consent updates to fail for users and brands. This makes consent updates reliable so downstream systems see correct user permissions before they act.