Add Stripe webhook handler and update env/docs for Stripe integration

[feispla]

Motivation

• Add server-side handling for Stripe webhook events to securely verify incoming requests.
• Simplify example environment variables to surface Stripe credentials and the application URL.
• Document how to configure Stripe and Vercel to use the new webhook route.

Description

• Add a new serverless endpoint at api/stripe-webhook.js that reads the raw request body, parses the Stripe-Signature header, computes the expected HMAC-SHA256 using STRIPE_WEBHOOK_SECRET, performs a timing-safe signature comparison, and returns 200 for verified events or 4xx/5xx for errors.
• Replace and simplify .env.example entries to include STRIPE_SECRET_KEY, STRIPE_PUBLISHABLE_KEY, STRIPE_WEBHOOK_SECRET, and APP_URL.
• Update docs/INTEGRATIONS.md with step-by-step instructions for configuring Stripe webhooks and Vercel environment variables, including guidance to rotate exposed credentials and where to point the webhook (/api/stripe-webhook).

Testing

• Ran the project lint with npm run lint; it completed successfully.
• Ran the existing automated test suite with npm test; all tests passed.

---

Codex Task

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
feishtml	Ready	Preview, Comment	May 15, 2026 7:21am

[supabase]

This pull request has been ignored for the connected project nejzzerwtgtbqawaizuo because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.