Payment Webhooks Create

Handle Stripe webhook events.

Signature enforcement is opt-in via settings.STRIPE_WEBHOOK_SECRET so we can roll the code out as a no-op and flip enforcement on later by setting the secret in ASM + reloading the server.

• Strict mode (secret set): the Stripe-Signature HMAC is verified against the configured secret. Missing header, bad signature, or malformed payload all reject with 400 before any handler runs. This closes the unauthenticated-credit-injection vector.
• Lenient mode (secret unset/empty): bit-for-bit identical to the pre-fix behavior (stripe.Event.construct_from(request.data, stripe.api_key)). Logs a warning + tags the dogfood span with enforcement_mode=lenient so traces make the vulnerability visible. This is the deploy-day default.

Dogfood tracing: every request tags stripe.webhook.enforcement_mode (strict|lenient) and every failure branch tags stripe.webhook.failure_reason so incident responders can triage in the trace UI without code-diving.