feat(billing): P1c Stripe dep + server client + vault-backed config

Pin stripe@22.1.1 (exact). lib/stripe/client.ts: per-request getStripe
with the pinned apiVersion (server-only, never global/client). Helpers
in lib/stripe/config.ts (plain server module — they take the admin
client so they must NOT be 'use server' exports): store/read the secret
key + webhook signing secret in the AES-256-GCM secrets vault (door
pattern), getStripeConfig. lib/actions/stripe.ts (actions only):
getStripeSettings (status only, never returns secrets) + saveStripeSettings
(write-only secrets, integrations.config upsert). Zod stripeSettingsSchema.

lib/validations.ts

@@ -1006,6 +1006,17 @@ export const bulkMemberIdsSchema = z
   .min(1, 'Select at least one member')
   .max(1000)
 
+// Stripe dues config (admin). Secret fields are write-only: omitted/blank
+// means "keep the stored one". prices maps a membership tier -> Stripe Price.
+export const stripeSettingsSchema = z.object({
+  mode: z.enum(['test', 'live']),
+  publishable_key: z.string().trim().max(255).optional().nullable(),
+  secret_key: z.string().trim().max(255).optional().nullable(),
+  webhook_secret: z.string().trim().max(255).optional().nullable(),
+  grace_days: z.number().int().min(0).max(90).optional().default(7),
+  prices: z.record(z.string().trim().max(255)).optional().default({}),
+})
+
 // Helper type exports
 export type CreateTaskInput = z.infer<typeof createTaskSchema>
 export type CreateProjectInput = z.infer<typeof createProjectSchema>