feat: Stripe integration — checkout + webhook + subscription lifecycle

- src/lib/stripe/index.ts: Stripe client (checkout session + webhook event)
- POST /api/aos/stripe/checkout: create subscription checkout for a license
- POST /api/aos/stripe/webhook: handle events:
  - checkout.session.completed → link Stripe customer/subscription to license
  - invoice.paid → activate license (remove trial)
  - customer.subscription.deleted → cancel license + schedule instance deletion
  - invoice.payment_failed → suspend license (dunning)
- Middleware: stripe/webhook is public (Stripe calls it without auth)
- stripe package installed (v23)

src/middleware.ts

@@ -9,6 +9,7 @@ const PUBLIC_PATHS = [
   '/api/aos/seed-prod',
   '/api/aos/licenses/check',
   '/api/aos/licenses/validate',
+  '/api/aos/stripe/webhook',
   '/login',
   '/_next',
   '/favicon.ico',
@@ -22,6 +23,7 @@ const PUBLIC_API_PREFIXES = [
   '/api/aos/seed-prod',
   '/api/aos/licenses/check',
   '/api/aos/licenses/validate',
+  '/api/aos/stripe/webhook',
   '/api/v1/',  // public REST API (token-auth'd separately)
   '/api/mcp',  // MCP (token-auth'd)
 ]