Webhook

Handle Stripe platform-subscription webhooks.

Listens to checkout.session.completed only. On every successful Checkout completion in mode: "subscription", flips the org's subscription flag in BOTH places we read it from:

• WorkOS organization.metadata.org_subscription = "true" — source of truth for session JWTs (WorkOS stamps it into the JWT at issuance).
• Mongo org_private_data.org_subscription = True — local mirror used by the API-key auth path, which has no JWT to read claims from.

Revocation (cancel, dunning exhaustion, etc.) is reconciled out-of-band by notebooks/billing/audit_subscriptions.ipynb (which must also write both places when it runs).