feat: add Stripe subscription plugin

[lane711]

Summary

• Adds a new core plugin for Stripe subscription management with webhook handling, checkout sessions, and subscription gating
• Handles full subscription lifecycle: creation, updates, cancellation, payment success/failure
• Includes admin dashboard with stats cards, filterable subscription table, and Stripe Dashboard links

Changes

File	Description
stripe-plugin/index.ts	Plugin factory using PluginBuilder SDK
stripe-plugin/types.ts	TypeScript types for subscriptions, Stripe events, settings
stripe-plugin/manifest.json	Plugin metadata and settings schema
stripe-plugin/services/subscription-service.ts	D1 database CRUD, stats, pagination
stripe-plugin/services/stripe-api.ts	Lightweight Stripe API client (fetch-based, CF Workers compatible)
stripe-plugin/routes/api.ts	Webhook endpoint + authenticated API routes
stripe-plugin/routes/admin.ts	Admin dashboard route
stripe-plugin/components/subscriptions-page.ts	Admin UI rendering
stripe-plugin/middleware/require-subscription.ts	requireSubscription() route gating
core-plugins/index.ts	Register plugin exports
app.ts	Register plugin routes

API Endpoints

• POST /api/stripe/webhook — Stripe webhook (signature verified, no auth)
• POST /api/stripe/create-checkout-session — Create checkout session (auth required)
• GET /api/stripe/subscription — Current user's subscription status (auth required)
• GET /api/stripe/subscriptions — List all subscriptions (admin only)
• GET /api/stripe/stats — Subscription stats (admin only)
• GET /admin/plugins/stripe — Admin dashboard

Testing

• Unit tests pass locally (1436 tests, 0 regressions)
• TypeScript compiles cleanly (tsc --noEmit)

Checklist

• Code follows existing plugin conventions (modeled after security-audit-plugin)
• No new TypeScript errors introduced
• Webhook signature uses timing-safe comparison to prevent timing attacks
• No Stripe SDK dependency (uses fetch + Web Crypto API for CF Workers)

Closes #760

🤖 Generated with Claude Code