Bulk-clean stripe_customer_id rows orphaned by the test→live key flip.

ROAD-002 §WP-A task 4. When the prod Stripe key flipped from test to live, every stripe_customer_id minted under the test key became "No such customer" under the live key — a 400→503 on that user's next checkout. The checkout handler now self-heals lazily (null + recreate + retry once), so this endpoint is the proactive counterpart: verify each stored customer against the current key and NULL the ones Stripe no longer knows.

Only rows Stripe positively reports as GONE (404) are cleared. Any indeterminate signal (network error, rate-limit, unexpected status) leaves the row untouched — we never destroy a mapping on an ambiguous answer.

Authorization: - Anonymous → 401 (auth dep on require_admin). - Authenticated non-admin → 403 (require_admin). - Admin (email in ADMIN_EMAILS) → 200.

Flag gate (rule #4): 404 when ADMIN_DASHBOARD_ENABLED is off, so the whole /admin/* surface stays uniformly gated.

503 "Stripe not configured" (Sentry-allowlisted) when no key is set.

Response (counts only — never an email or a customer id): {"dry_run": bool, "scanned": int, "stale": int, "cleared": int, "indeterminate": int}