fix(stripe): whitelist webhook path in proxy so Stripe is not redirected to /login

proxy.ts auth-gates every non-public path and 307-redirects to /login.
The Stripe webhook is called without a session, so it was being
redirected; Stripe does not follow redirects, so every webhook delivery
would have failed. Add /api/stripe/webhook to PUBLIC_ROUTES (scoped to
the webhook path only) and correct the route/header comments that wrongly
claimed there was no auth middleware. Caught by smoke-testing the
deployed route (POST returned 307 instead of 400).

app/api/stripe/webhook/[space]/route.ts

@@ -2,8 +2,11 @@
 // path to know which signing secret to verify with). Raw body, signature
 // verify, idempotency on Stripe's stable event id, then map the subscription
 // lifecycle onto member_billing + member status (grace -> late, never auto-
-// inactive). Unauthenticated by design (Stripe calls it); there is no auth
+// inactive). Unauthenticated by design (Stripe calls it). proxy.ts auth-
-// middleware in this app, and every DB write is post-signature-verify.
+// gates everything by default and redirects to /login, which Stripe would
+// NOT follow — so this exact path is whitelisted in proxy.ts PUBLIC_ROUTES.
+// Trust is the per-space webhook signature; every DB write is
+// post-signature-verify.
 import { NextRequest, NextResponse } from 'next/server'
 import type Stripe from 'stripe'
 import { createAdminClient } from '@/lib/supabase/admin'

proxy.ts

@@ -16,6 +16,11 @@ const PUBLIC_ROUTES = [
   '/track',
   '/auth',
   '/api/health',
+  // Stripe calls this unauthenticated; it is verified by the per-space
+  // webhook signature, not a session. Must NOT be redirected to /login
+  // (Stripe does not follow redirects). Scoped to the webhook path only —
+  // the Stripe server actions are invoked from authenticated pages.
+  '/api/stripe/webhook',
   // Public form / waiver fill page. Only /f/[slug] lives here and must be
   // reachable anonymously (the page serves only published public forms and
   // submitForm enforces visibility). The /forms* management routes do NOT