fix: secure stripe webhook secret selection 🔒

Prevents usage of test secrets in production environment.
Added regression test in `tests/security/test_stripe_webhook_security.py`.
Documented findings in `SECURITY_AUDIT.md`.
Configured Vulture to exclude security test file in `pyproject.toml`.

Author: google-labs-jules[bot]

pyproject.toml

@@ -71,7 +71,8 @@ exclude = [
     "src/api/auth/",
     "src/utils/integration/",
     "src/stripe/",
-    "scripts/"
+    "scripts/",
+    "tests/security/test_stripe_webhook_security.py"
 ]
 ignore_names = [
     "apply_referral",