Receive a Stripe webhook. NO auth dependency — the signature is the auth.

Two try blocks, and the split between them is the whole safety argument: the FIRST covers only parsing of an untrusted payload and answers 4xx; the SECOND covers our own I/O (Stripe, Postgres) and answers 5xx. A single combined block was the earlier shape and was wrong — a TypeError raised while reading Stripe's own re-fetched object (say, another change to where current_period_end lives) would have been reported as "bad payload" and the event dropped for good.