Stripe webhook → Supabase fulfillment

The exact pattern this very site uses. Verify → write with service role → be idempotent (Stripe retries).

copy// preview
const event = stripe.webhooks.constructEvent(body, sig, secret);
if (event.type === "checkout.session.completed") {
  await admin.from("purchases").upsert(
    { user_id, item_id, stripe_payment_id },
    { onConflict: "user_id,item_id" }, // idempotent
  );
}

Full route (subscription events + refunds + a replay-safety note) for members.