Billing
The browser can only ask for a Checkout link; entitlement is decided by a signature-verified webhook reading raw bytes.
The browser can do exactly one billing thing: ask for a Checkout link. It never states what plan someone is on and the server never believes it if it does. Entitlement is decided in one place — a webhook whose signature is verified against the Stripe secret — and written with the service role key.
Signature verification is load-bearing, not hygiene: without it that endpoint is an open door where anyone who guesses the URL POSTs themselves a subscription. The body is read as raw bytes for the same reason — string concatenation re-encodes, and one multi-byte character on a chunk boundary breaks verification in a way that looks exactly like a wrong secret.
ENTITLED = { active, trialing, past_due } — a failed payment does not cut access off mid-retry. An unrecognised price id becomes free rather than a guess: a rotated price should cost a support ticket, not hand out a tier.
checkout.session.completed re-retrieves the subscription rather than trusting the session, because the session carries a snapshot and the subscription carries the truth.
Stripe returns the browser before the webhook necessarily lands, so the app polls the profile for about 20 seconds and says "turning your plan on" rather than showing Free to somebody who has just paid.