Stripe Webhook

Stripe webhook handler — processes subscription events.

This endpoint does NOT require Bearer auth. Instead, Stripe signs the payload with the webhook secret, which we verify.

Handled events:

• checkout.session.completed — activate plan
• customer.subscription.updated — update plan on change
• customer.subscription.deleted — downgrade to free
• invoice.paid — reset quota on billing cycle renewal
• invoice.payment_failed — log warning

IMPORTANT: invoice.paid must be registered in the Stripe Dashboard webhook settings for monthly quota reset to work.