Billing Webhook Wechat

WeChat Pay v3 async notification endpoint.

Verifies the RSA signature with the platform certificate (lib handles auto-refresh), decrypts the AES-GCM payload using apiv3_key, and on trade_state=SUCCESS marks the order paid + activates the user's subscription.

Idempotent: WeChat may retry the same notification multiple times across the 50-minute retry window — a re-delivery for an already-paid order is a no-op and still returns SUCCESS so the retries stop.

Returns the WeChat-required ack body ({code, message}) with HTTP 200 on success and HTTP 200 + FAIL ack on bad payload (so we don't accidentally bury misconfigurations under WeChat retries).