Receive a Stripe webhook event

Receives a Stripe webhook event and, for checkout.session.completed, posts the matching credit to the organization's ledger and marks the checkout session complete. Not bearer-authenticated: the request is authenticated by Stripe's Stripe-Signature header, verified against the raw request body and the endpoint's webhook signing secret. Credit posting is idempotent — replaying the same event id posts the credit only once. Returns 200 for any verified event (handled or not) so Stripe stops retrying; a signature failure returns 400.