Payment Webhooks Create

Handle Stripe webhook events. Signature enforcement is **opt-in** via ``settings.STRIPE_WEBHOOK_SECRET`` so we can roll the code out as a no-op and flip enforcement on later by setting the secret in ASM + reloading the server. - Strict mode (secret set): the ``Stripe-Signature`` HMAC is verified against the configured secret. Missing header, bad signature, or malformed payload all reject with 400 before any handler runs. This closes the unauthenticated-credit-injection vector. - Lenient mode (secret unset/empty): bit-for-bit identical to the pre-fix behavior (``stripe.Event.construct_from(request.data, stripe.api_key)``). Logs a warning + tags the dogfood span with ``enforcement_mode=lenient`` so traces make the vulnerability visible. This is the deploy-day default. Dogfood tracing: every request tags ``stripe.webhook.enforcement_mode`` (strict|lenient) and every failure branch tags ``stripe.webhook.failure_reason`` so incident responders can triage in the trace UI without code-diving.