Stripe webhook for Watching subscriptions — verify payment and fulfill the exact record

Verifies Stripe-Signature with STRIPE_WEBHOOK_SECRET and re-reads current Stripe subscription state. Only an exact supported price, confirmed payment, and explicit unambiguous business identity grant entitlement. Per-subscription Durable Object storage coordinates event and baseline dedupe; CONSUMERS is a discovery index. Disabled sending or failed fulfillment remains retryable. Stable provider keys and a frozen outbox payload protect retries. A pending provider outcome older than 23 hours requires reconciliation. Paying never changes what the public receipt shows.