Stripe Webhook

Signed with the endpoint's secret (Stripe-Signature, HMAC-SHA256 over "<t>.<body>", 5-minute tolerance). Every event is recorded once by its id. customer.subscription.* events overwrite the account's subscription state with the object they carry; checkout.session.completed attaches the customer to the account and, if the subscription event has not arrived yet, fetches the subscription so the account is never left half-linked.