Webhook for Stripe events on hand-off invoices and patient payment links.

The body is read raw so an unparseable payload can be answered with a 200 rather than a validation error: Stripe retries non-2xx deliveries for days, and a body we can't parse now won't parse on a retry either. The raw bytes are also what the signature covers.

An unsigned or badly signed delivery is rejected with a 401 before it is parsed.