Alipay 当面付 async-notify endpoint.

Verifies RSA2 signature over the urlencoded form using the Alipay public key, then on trade_status in {TRADE_SUCCESS, TRADE_FINISHED} finalizes the order via the shared _finalize_order_paid() helper.

Idempotent on re-delivery (Alipay retries up to 25 times across ~24h with backoff). The handler must return the literal text body success (HTTP 200) for Alipay to stop retrying — any other body, status, or even a JSON {"status":"success"} triggers indefinite retries until the 25-attempt window expires.