Add Stripe checkout to an existing app

Products, checkout session, webhook and the entitlement check — written so the agent cannot skip the webhook.

Add subscription billing to this app using Stripe. Work in the order below and show me the diff at each step.

STEP 1 — PLAN
Describe the flow you will implement, the tables you will add and every secret you need. Wait for approval.

STEP 2 — DATA
Add a subscriptions table: user id, stripe customer id, stripe subscription id, price id, status, current period end.

STEP 3 — CHECKOUT
Server function that creates a Checkout Session for a given price id with the current user's email, success and cancel URLs.

STEP 4 — WEBHOOK
Handle checkout.session.completed, customer.subscription.updated and customer.subscription.deleted. Verify the signature. The webhook — not the success page — is the only thing that grants access.

STEP 5 — ENTITLEMENT
A single helper, hasActiveSubscription(userId), used by every protected route and the pricing UI.

RULES
- Secret keys only on the server, never in client code.
- Webhook handler is idempotent.
- Never trust the client for subscription status.

ACCEPTANCE CRITERIA
- Test-mode purchase unlocks the feature end to end.
- Cancelling in the Stripe dashboard revokes access after the webhook fires.