Stripe payment integration

[Zwiterrion]

Tracking issue for the remediation work that came out of an adversarial review of the Stripe payment integration (single entry point: PaymentClient.scala, raw WSClient, no Stripe SDK).

Verdict

The third-party payment feature is an unfinished MVP:

• Does it work today? The flat-subscription path (costPerMonth only) probably works; the metered / pay-per-request path is broken on recent Stripe accounts; several functions are stubs.
• Is it up to date? No — it uses the legacy usage-based billing APIs Stripe removed in 2025-03-31.basil, and no Stripe-Version is pinned.
• What's missing? Webhooks (reliable confirmation), idempotency, failure/cancellation handling, Stripe-side cleanup, and any test coverage.
• Security: the Stripe secret key leaks into the SPA payload served to the browser.

Sub-issues (suggested order)

• Stripe secret key leaked into the SPA payload (toUiPayload) #1148 — 🔴 Security: Stripe secret key leaked into the SPA payload (toUiPayload)
• Stripe: migrate metered billing to the Billing Meters API + pin Stripe-Version #1149 — 🔴 Migrate metered billing to the Billing Meters API + pin Stripe-Version
• Stripe: add signed webhooks for reliable payment confirmation #1150 — 🟠 Add signed webhooks for reliable payment confirmation
• Stripe: implement stopPayment + fix billing portal legal URLs #1151 — 🟠 Implement stopPayment + fix billing portal legal URLs
• Stripe: harden PaymentClient (idempotency, bugs, currencies, 429) #1152 — 🟡 Harden PaymentClient (idempotency, bugs, currencies, 429)
• Stripe: test coverage for the payment flow (mock api.stripe.com) #1153 — 🟡 Test coverage for the payment flow (mock api.stripe.com)

Related existing issues

• Reconcile enabled subscriptions with Otoroshi: Daikoku as the source of truth #1130 — Reconcile enabled subscriptions with Otoroshi: Daikoku as the source of truth (overlaps with webhooks Stripe: add signed webhooks for reliable payment confirmation #1150).
• Subscription deletion: offload heavy work to the queue job #1109 — Subscription deletion: offload heavy work to the queue job (overlaps with stopPayment cleanup Stripe: implement stopPayment + fix billing portal legal URLs #1151 and the additive usage-sync double-count noted in QueueJob.scala:508).
• extend the portal subscription model beyond API key delivery #786 — Extend the portal subscription model beyond API key delivery (broader payment/portal context).