fix(security): enforce shared billing idempotency boundaries

[drewstone]

Summary

• Require shared atomic idempotency storage for production webhook and Stripe dispatch.
• Deduplicate before asynchronous delivery, release failed claims, and preserve successful claims through their TTL.
• Serialize filesystem subscription compare-and-set writes across workers.
• Bind Stripe lifecycle and invoice events to the stored customer and subscription identity.
• Enforce the shared verified-real-email and no product-funded-credit policy at the integration boundary.
• Reject broker tokens from user identity, owner, connect, revoke, and management paths.

Root cause

Process-local replay maps and stale identity assumptions allowed separate workers or malformed cross-tenant events to pass independently.

Proof

• pnpm test: 637/637 files and 4,766/4,766 tests passed.
• Focused concurrency and policy tests: 25/25 passed.
• Security-path tests: 174/174 passed.
• pnpm typecheck: passed.
• pnpm build: passed.
• pnpm audit:execution: passed.
• git diff --check: passed.
• Semgrep security audit: 22 rules, 22 files, 0 findings.
• 100-worker claim test: exactly 1 winner and 99 rejects.
• 100-request router and dispatcher tests: exactly 1 delivery/event success.
• git merge-tree --write-tree origin/main HEAD: clean, tree 757c3f87c6397dabf657bd8577454f61a29ce670.

This is a draft for review. It is not merged or deployed.