Billing Webhook Mock

Dev-only: manual mock-provider webhook to finalise an order.

Not enabled in prod (Phase 2 ships real WeChat / Alipay webhooks with signature verification). For dev / e2e tests, POST {"order_no": "ord_..."} to bump the order to 'paid' and trigger activate_subscription. Idempotent on the order_no — a duplicate callback is a no-op rather than a double-charge.