fix(stripe): whitelist webhook path in proxy so Stripe is not redirected to /login

proxy.ts auth-gates every non-public path and 307-redirects to /login.
The Stripe webhook is called without a session, so it was being
redirected; Stripe does not follow redirects, so every webhook delivery
would have failed. Add /api/stripe/webhook to PUBLIC_ROUTES (scoped to
the webhook path only) and correct the route/header comments that wrongly
claimed there was no auth middleware. Caught by smoke-testing the
deployed route (POST returned 307 instead of 400).

proxy.ts

@@ -16,6 +16,11 @@ const PUBLIC_ROUTES = [
   '/track',
   '/auth',
   '/api/health',
+  // Stripe calls this unauthenticated; it is verified by the per-space
+  // webhook signature, not a session. Must NOT be redirected to /login
+  // (Stripe does not follow redirects). Scoped to the webhook path only —
+  // the Stripe server actions are invoked from authenticated pages.
+  '/api/stripe/webhook',
   // Public form / waiver fill page. Only /f/[slug] lives here and must be
   // reachable anonymously (the page serves only published public forms and
   // submitForm enforces visibility). The /forms* management routes do NOT