Stripe's callback. Signature-verified, stored, then processed (D1, G5).

The order matters and is the whole reason this is a table rather than a handler. The event lands in stripe_webhook_events BEFORE anything acts on it, and the duplicate test is processed_at IS NOT NULL rather than "have I seen this id": a crash between the insert and the handler must leave a work item that Stripe's redelivery picks up, not a row that makes the redelivery look like a duplicate and drop it.

404 while dark, so the route is not observable and does not offer a signature oracle to anyone probing for one.