#914/#871 — read-only LIVE webhook config check (Pillar 3 decisive gate)

Report whether the Stripe webhook config can actually promote a payer.

Read-only: one GET /v1/webhook_endpoints; no mutation, no secret material returned. Covers founder checks 1+2 from #871 (endpoint exists/enabled at the Badge path; both promotion events subscribed). Checks 3 (signing-secret match) and 4 (customer receipt email) are not API-readable and remain the manual dashboard checklist.

Authorization: - Anonymous → 401 (auth dep) · non-admin → 403 (require_admin) - Dashboard flag off → 404 (same posture as the other admin tiles)