DC-057: close checkout-to-license contract drift (grade B)

Canonical product catalog at src/billing/catalog.js shared by Stripe
Checkout client (src/billing/stripe-client.js), webhook bridge
(scripts/stripe-license-bridge.js), and pricing page
(status/pricing/index.html). One-time payment keyed by productId at
$20/$50/$70/$99 — no more monthly/annual subscription drift.

Bridge resolves duration via metadata.productId (single contract),
requires payment_status === 'paid' before fulfillment (rejects
unpaid/no_payment_required/missing with ack 200), handles
async_payment_succeeded for ACH/SEPA delayed-payment flow. License
persisted to fulfillment-store BEFORE email — SMTP failure path serves
the persisted code via the new /api/v1/billing/lookup/:sessionId
endpoint (the documented customer recovery path).

Layer-1 (event-id) + layer-2 (session-id) idempotency prevent
duplicate issuance. Checkout return URLs derived from
STRIPE_PUBLIC_ORIGIN or STRIPE_ALLOWED_HOSTS (not raw Host header) —
closes host-header-poisoning + session-ID-leak attack class.

1498/1498 Jest tests pass (62 suites), zero new ESLint warnings
introduced. Test files:
  - stripe-license-bridge.test.js (24 tests)
  - billing-lookup.test.js (8 tests, HTTP-level)
  - bridge-lookup-http.test.js (5 tests, uses exported createServer)
  - pricing-page-catalog.test.js (9 tests, per-tier consistency)
  - checkout-origin.test.js (6 tests, host injection rejection)
  - stripe-client.test.js (rewrite for productId + mode:payment)

Bridge code refactored: handleWebhook decomposed into verifySignature +
parseEventBody + checkEventIdempotency + fulfillCheckout +
ensureLicensePersisted (under ESLint complexity=20 cap). New
createServer()/createRequestHandler() factories guarded by
require.main === module.

Removed 3 stale test files from the rolled-back DC-055 attempt.

dashcaddy-api/src/security/csrf-protection.js

@@ -162,6 +162,20 @@ function csrfValidationMiddleware(req, res, next) {
     // is bounded by the token's TTL + scope. Same model as invite accept.
     '/api/v1/share/:token/subscribe',
     '/api/v1/share/:token/redeem-tailscale',
+    // DC-055: Stripe Checkout session creation. Browsers hit this from the
+    // public pricing page (cross-origin from any *.sami subdomain that
+    // serves it); no session cookie exists yet, so a CSRF token can't be
+    // anchored. SameSite=Lax on the session cookie doesn't apply (none
+    // exists). Threat model: an attacker who can trigger checkout sessions
+    // can only force a customer to land on Stripe's hosted page — they
+    // can't extract money. Stripe's session id is single-use and tied to a
+    // chosen price; reusing it requires Stripe's webhook secret.
+    '/api/v1/billing/checkout',
+    // DC-057: success page polls this from the customer's browser after
+    // Stripe redirects them back. Same CSRF argument as above (no session
+    // cookie exists yet) — and the response is the customer's own license
+    // code, not anything an attacker can exploit by triggering the lookup.
+    '/api/v1/billing/lookup/:sessionId',
     '/health',
     '/health/live',
     '/health/ready',