Add Inbound Subscription Billing Webhook Stub

[aji70]

Task: Add Inbound Subscription Billing Webhook Stub

Overview

Subscriptions are manually toggled with no payment lifecycle. An inbound webhook stub simulates Stripe-style events for future billing integration.

---

Goals

• POST /api/v1/webhooks/billing — HMAC via BILLING_WEBHOOK_SECRET (optional in dev)
• Events: subscription.activated, subscription.cancelled, payment.failed
• Idempotency via stored eventId
• Map stub external IDs to local Subscription rows

---

Deliverables

• Billing webhook controller + signature helper
• Optional past_due status on payment failure
• Audit logging + tests for each event type

---

Acceptance Criteria

• Valid subscription.activated creates or reactivates subscription
• payment.failed marks past_due without deleting row
• Replay of same eventId is a no-op (200)
• Invalid signature returns 401 when secret configured
• At least 8 tests