Stripe's event delivery — signature-authenticated

Authenticated by the Stripe-Signature header (HMAC over the raw body, five-minute tolerance), never by key or cookie. A verified event may move profile.plan between free and pro and record the Stripe customer/subscription ids — nothing else. Billing plumbing only: it touches no corpus table and asserts nothing about the law — POST /v1/review/verdict remains the only route that does.