Stripe webhooks — idempotent, signature-verified, fail-safe

HMAC-SHA256 signature verification, idempotency on event_id, the raw-body trap, the full subscription lifecycle, and the retry behavior you need to plan for.