feat(billing): P1c Stripe dep + server client + vault-backed config

Pin stripe@22.1.1 (exact). lib/stripe/client.ts: per-request getStripe
with the pinned apiVersion (server-only, never global/client). Helpers
in lib/stripe/config.ts (plain server module — they take the admin
client so they must NOT be 'use server' exports): store/read the secret
key + webhook signing secret in the AES-256-GCM secrets vault (door
pattern), getStripeConfig. lib/actions/stripe.ts (actions only):
getStripeSettings (status only, never returns secrets) + saveStripeSettings
(write-only secrets, integrations.config upsert). Zod stripeSettingsSchema.

lib/stripe/client.ts

@@ -0,0 +1,10 @@
+// Server-only. Per-space OWN keys (NOT Connect): a fresh client is created
+// per request with that space's decrypted secret key. Never memoize a global
+// client and never expose the key to the browser. The API version is pinned
+// in lib/stripe-logic so an SDK/API bump is a deliberate, reviewed change.
+import Stripe from 'stripe'
+import { STRIPE_API_VERSION } from '@/lib/stripe-logic'
+
+export function getStripe(secretKey: string): Stripe {
+  return new Stripe(secretKey, { apiVersion: STRIPE_API_VERSION as Stripe.LatestApiVersion })
+}