Stripe webhook. Verifies the signature, then on checkout.session.completed fulfils the stored intent (entitlement for items; owner membership for tenants). Idempotent per Stripe event id.

Status contract (what Stripe sees — docs/go-live-eu-marketplace-runbook.md):

• 400 bad_signature ONLY for a delivery whose signature does not verify (details.reason: missing_header | malformed_header | timestamp_outside_tolerance | no_matching_secret);
• 400 bad_payload for a verified body that is not a JSON object (Stripe never sends one);
• 503 webhook_unconfigured / billing_unavailable when WE cannot verify or record yet — Stripe retries, and the log no longer blames a signature that was never checked;
• 200 for every verified event, including types we do not handle, thin (v2) events, events from the other Stripe mode, duplicates and events for a checkout we do not know;
• 5xx when fulfilment itself fails, so Stripe redelivers.