Add apps/stripe service for Stripe webhook handling

[devin-ai-integration]

Summary

Adds a new dedicated apps/stripe application for Stripe webhook handling. This PR does not modify apps/api - it only adds the new service to enable a safe rollout strategy:

1. Deploy apps/stripe
2. Update Stripe dashboard to point webhooks to new service
3. Monitor and verify
4. Remove Stripe webhook code from apps/api in a follow-up PR

What's in apps/stripe:

• Stripe webhook route (POST /webhook/stripe)
• billing-bridge.ts (syncBillingBridge function)
• stripe-sync.ts integration
• Stripe middleware for webhook signature verification
• Health check endpoint (GET /health)
• All stripe-*.ts scripts (backfill, sync-entitlements, etc.)

The new service includes Dockerfile and fly.toml for Fly.io deployment on port 8788.

Updates since last revision

• Added stripe_cd.yaml GitHub Actions workflow for Fly.io deployment (same pattern as api_cd.yaml)
• Added doxxer.stripe.toml for version tagging (stripe_v* tags)

Review & Testing Checklist for Human

• Create Fly.io app: Run fly apps create hyprnote-stripe before first deployment
• Environment variables: Set all required env vars in Fly.io: DATABASE_URL, SUPABASE_URL, SUPABASE_SERVICE_ROLE_KEY, STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET, SENTRY_DSN (optional)
• Test webhook endpoint locally: Run pnpm -F @hypr/stripe dev and send a test webhook using Stripe CLI
• Verify CD workflow: After merging, manually trigger stripe_cd.yaml and verify deployment succeeds
• Stripe webhook URL update: After deploying, update Stripe dashboard to point webhooks to the new hyprnote-stripe service URL
• Monitor after cutover: Watch Sentry and logs for any webhook processing errors after switching traffic

Recommended test plan:

1. Create hyprnote-stripe app in Fly.io and set environment variables
2. Deploy via stripe_cd.yaml workflow (manual dispatch)
3. Use Stripe CLI to send test webhooks to the new service URL
4. Verify webhook events are processed correctly (check database for expected updates)
5. Update Stripe dashboard webhook URL
6. Monitor production traffic for errors

Notes

Requested by @yujonglee

Devin session: https://app.devin.ai/sessions/bcc7b78aed544138bc19afb3adfc277c

[netlify]

✅ Deploy Preview for hyprnote-storybook canceled.

Name	Link
🔨 Latest commit	2e7d7bf
🔍 Latest deploy log	https://app.netlify.com/projects/hyprnote-storybook/deploys/698421deffd4d10008a5b1d0

[netlify]

✅ Deploy Preview for hyprnote canceled.

Name	Link
🔨 Latest commit	2e7d7bf
🔍 Latest deploy log	https://app.netlify.com/projects/hyprnote/deploys/698421de7b5eb500089d772d

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR that start with 'DevinAI' or '@devin'.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[devin-ai-integration]

Devin Review found 1 potential issue.

⚠️ 1 issue in files not directly in the diff

⚠️ STRIPE_WEBHOOK_SECRET still required in apps/api env validation despite webhook being moved (apps/api/src/env.ts:20)

The apps/api/src/env.ts still requires STRIPE_WEBHOOK_SECRET as a mandatory environment variable (line 20), but the Stripe webhook handling has been moved to apps/stripe. The Stripe middleware was removed from apps/api/src/middleware/index.ts and the /webhook/stripe route was removed from apps/api/src/routes/webhook.ts.

Root Cause

The env validation at apps/api/src/env.ts:20 defines STRIPE_WEBHOOK_SECRET: z.string().min(1) as a required field. However, after the extraction, this secret is only needed in apps/stripe (which correctly defines it in apps/stripe/src/env.ts:14).

Impact: The apps/api service will fail to start if STRIPE_WEBHOOK_SECRET is not provided in the environment, even though this value is no longer used by the API. This creates an unnecessary deployment dependency and could cause issues when setting up new environments.

View 5 additional findings in Devin Review.

[devin-ai-integration]

Devin is archived and cannot be woken up. Please unarchive Devin if you want to continue using it.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 4 additional findings.