Stripe webhook receiver (signature-verified)

Handles checkout.session.completed, checkout.session.async_payment_succeeded, checkout.session.async_payment_failed, customer.subscription.updated and customer.subscription.deleted. Fulfilment is gated on payment_status, so a delayed method (boleto) fulfils on async_payment_succeeded, not on the earlier completed. Idempotent: each plan handler assigns an absolute state, so replays converge; a credit-pack purchase is a delta deduplicated by Checkout Session id. A storage failure returns 500 so Stripe re-delivers (safe under idempotency).