Receive Stripe billing webhook

Stripe-signed webhook for checkout.session.completed and customer.subscription.* events. The raw body is stream-bounded to 262144 bytes before signature verification. Required Stripe event id/type/created fields are persisted as a payload-hash-bound replay receipt; per-subscription ordering rejects older delivery before state can roll backward. Stripe event ids are opaque, so different events with the same created second are recorded as ambiguous_order and never automatically applied until a newer provider event resolves state. User updates require no account-deletion fence; fenced events remain durable deletion evidence. This endpoint uses Stripe-Signature, not API-key auth.