feat(billing): P1c Stripe dep + server client + vault-backed config

Pin stripe@22.1.1 (exact). lib/stripe/client.ts: per-request getStripe
with the pinned apiVersion (server-only, never global/client). Helpers
in lib/stripe/config.ts (plain server module — they take the admin
client so they must NOT be 'use server' exports): store/read the secret
key + webhook signing secret in the AES-256-GCM secrets vault (door
pattern), getStripeConfig. lib/actions/stripe.ts (actions only):
getStripeSettings (status only, never returns secrets) + saveStripeSettings
(write-only secrets, integrations.config upsert). Zod stripeSettingsSchema.

lib/stripe/client.ts

@@ -0,0 +1,10 @@
+// Server-only. Per-space OWN keys (NOT Connect): a fresh client is created
+// per request with that space's decrypted secret key. Never memoize a global
+// client and never expose the key to the browser. The API version is pinned
+// in lib/stripe-logic so an SDK/API bump is a deliberate, reviewed change.
+import Stripe from 'stripe'
+import { STRIPE_API_VERSION } from '@/lib/stripe-logic'
+
+export function getStripe(secretKey: string): Stripe {
+  return new Stripe(secretKey, { apiVersion: STRIPE_API_VERSION as Stripe.LatestApiVersion })
+}

lib/stripe/config.ts

@@ -0,0 +1,88 @@
+// Server-only helpers (NOT a 'use server' module — these take a Supabase
+// admin client and are imported by server actions + the webhook route).
+// Per-space Stripe config lives in integrations.config; the secret key and
+// webhook signing secret live in the AES-256-GCM secrets vault, referenced
+// by id from config.
+import type { createAdminClient } from '@/lib/supabase/admin'
+import { encryptSecret, decryptSecret, encryptionAvailable } from '@/lib/secrets/crypto'
+
+type Admin = ReturnType<typeof createAdminClient>
+
+export type StripeConfig = {
+  mode?: 'test' | 'live'
+  publishable_key?: string
+  secret_key_ref?: string
+  webhook_secret_ref?: string
+  grace_days?: number
+  prices?: Record<string, string>
+}
+
+// Store a Stripe credential in the encrypted secrets vault (same layout the
+// door subsystem uses). Returns the secret row id to keep in config.
+export async function storeStripeSecret(
+  admin: Admin,
+  spaceId: string,
+  title: string,
+  value: string,
+  createdBy: string | null,
+): Promise<string | null> {
+  const row: Record<string, unknown> = {
+    space_id: spaceId,
+    title,
+    label: title,
+    category: 'integration',
+    created_by: createdBy,
+  }
+  if (encryptionAvailable()) {
+    const { ciphertext, version } = encryptSecret(value)
+    row.encrypted_value = ciphertext
+    row.encryption_version = version
+    row.value = ''
+  } else {
+    row.value = value
+    row.encryption_version = 0
+  }
+  const { data, error } = await admin.from('secrets').insert(row).select('id').single()
+  if (error || !data) return null
+  return data.id as string
+}
+
+// Read + decrypt a stored Stripe credential. Server-only; never returned to
+// a client.
+export async function readStripeSecret(
+  admin: Admin,
+  spaceId: string,
+  secretRef: string | null | undefined,
+): Promise<string | null> {
+  if (!secretRef) return null
+  const { data } = await admin
+    .from('secrets')
+    .select('encryption_version, encrypted_value, value')
+    .eq('id', secretRef)
+    .eq('space_id', spaceId)
+    .maybeSingle()
+  if (!data) return null
+  if (data.encryption_version === 1 && data.encrypted_value) {
+    const raw = data.encrypted_value as unknown
+    const buf =
+      typeof raw === 'string'
+        ? Buffer.from((raw as string).replace(/^\\x/, ''), 'hex')
+        : Buffer.from(raw as Uint8Array)
+    try {
+      return decryptSecret(buf, 1)
+    } catch {
+      return null
+    }
+  }
+  return (data.value as string | null) ?? null
+}
+
+export async function getStripeConfig(admin: Admin, spaceId: string): Promise<StripeConfig | null> {
+  const { data } = await admin
+    .from('integrations')
+    .select('config')
+    .eq('space_id', spaceId)
+    .eq('platform', 'stripe')
+    .maybeSingle()
+  return (data?.config as StripeConfig | null) ?? null
+}