Stripe Webhook

Receive and process Stripe webhook events.

Security:

• Verifies Stripe-Signature header using stripe.Webhook.construct_event.
• Returns 400 on invalid signature (must use raw bytes — request.body()).

Idempotency:

• Checks processed_webhook_events table before processing.
• Inserts event_id after success.
• Returns 200 even if event already processed (Stripe retries on non-2xx).

Handled events:

• customer.subscription.created → upsert subscriptions row
• customer.subscription.updated → upsert subscriptions row
• customer.subscription.deleted → set status='cancelled', owner alert
• invoice.paid → owner payment-received alert
• invoice.payment_failed → set status='past_due'
• payment_method.attached → set has_payment_method=true