fix: make stripe webhooks explicitly toggleable with mandatory secret validation

backend/src/api.rs

@@ -135,11 +135,12 @@ impl Api {
     }
 
     pub fn router(self) -> Router {
+        let stripe_webhooks_enabled = self.billing.webhooks_enabled();
         let state = AppState {
             api: Arc::new(self),
         };
 
-        Router::new()
+        let router = Router::new()
             .route("/identity", get(get_identity))
             .route("/plans", get(list_plans))
             .route("/plans/:id", get(get_plan))
@@ -157,9 +158,15 @@ impl Api {
             .route(
                 "/tenants/:pubkey/stripe/session",
                 get(create_stripe_session),
-            )
-            .route("/stripe/webhook", post(stripe_webhook))
-            .with_state(state)
+            );
+
+        let router = if stripe_webhooks_enabled {
+            router.route("/stripe/webhook", post(stripe_webhook))
+        } else {
+            router
+        };
+
+        router.with_state(state)
     }
 
     fn extract_auth_pubkey(&self, headers: &HeaderMap) -> std::result::Result<String, ApiError> {