Stripe customer portal (manage/cancel). Body: {stripe_customer_id}.

REAL SECURITY GAP FOUND + FIXED 2026-08-13 (Grok codebase sweep, independently verified): this endpoint has no Bearer/signature/session auth at all -- it used to also accept a bare {email}, look the customer up by it, and hand back a live Billing Portal URL (which can cancel the subscription, change the card, or change seat count). Anyone who merely knows a subscriber's email got their portal. The email-lookup path is removed: stripe_customer_id (a cus_... id) is not publicly knowable the way an email address is, so requiring it directly closes the practical attack path without a broader auth redesign. A stricter fix (binding this to the caller's own invinoveritas api_key via client_reference_id) is a real follow-up, not done here -- this endpoint may currently have no legitimate self-serve caller passing an api_key at all, and guessing that contract wrong risks breaking real subscription management.