feat(webhook): add local HTTP transport to account-webhook

[I-am-nothing]

Why

cmd/account-webhook is currently Lambda-only and refuses to start outside the Lambda runtime. That blocks the obvious local dev loop for verifying signature verification + idempotency + handler dispatch against real test-mode events:

stripe listen --forward-to localhost:8092/webhook

The sister cmd/account-api binary already runs in dual mode, and so does every comparable Lambda in api-platform (cmd/account, cmd/applications, cmd/dispatch). This PR brings account-webhook in line with that convention.

What

One body of logic, two thin transports — main() detects the Lambda runtime and dispatches:

if isLambda() {
    lambda.Start(proxyHandler(router))   // production
} else {
    http.ListenAndServe(":"+port, mux)   // local HTTP
}

Both transports decode the request body + + "Stripe-Signature" + header and feed them to the same webhook.Router.Process — the verifier and per-event handlers don't change.

Code changes

File	Change
cmd/account-webhook/main.go	Refactored: env-reading moved out of init() into buildRouter(); proxyHandler and new httpHandler are closures taking *webhook.Router (testable); main() dispatches via isLambda(); body wrapped in http.MaxBytesReader (512 KB) for local-path defense.
cmd/account-webhook/main_test.go	New — 5 transport-layer tests using local stubVerifier + stubStore. Covers bad signature, unhandled event, duplicate (idempotency short-circuit), and the Lambda transport's lowercase-header fallback.
Makefile	New make dev-webhook target.
CLAUDE.md	Quickstart updated.

Behavior matrix

Trigger	Mode	Port	Path
AWS_LAMBDA_FUNCTION_NAME set	Lambda	n/a	API-Gateway-routed
Otherwise	Local HTTP	ACCOUNT_WEBHOOK_PORT (default 8092)	/webhook

Why AWS_LAMBDA_FUNCTION_NAME?

Single env var, matching cmd/account-api/main.go:251 and api-platform/internal/shared/config/config.go. The first draft of this PR also probed AWS_EXECUTION_ENV; the /simplify reuse review flagged the divergence — fixed in this PR.

How to use locally

# 1. Boot Postgres
make db && make db-init

# 2. Source the dev env (contains STRIPE_WEBHOOK_SECRET, DATABASE_URL)
set -a; source .env.local; set +a

# 3. Start the webhook receiver on :8092
make dev-webhook

# 4. In another terminal — forward real Stripe test events
stripe listen --forward-to localhost:8092/webhook
# (copy the printed whsec_ into .env.local if not already there)

# 5. Trigger a test event from a third terminal
stripe trigger customer.created

The handler verifies signatures, marks the event processed (idempotent), and writes the side effects to ms_billing.*.

/simplify pass

Ran the 3-agent review before push. Applied fixes:

• A1#1 (HIGH) — Aligned isLambda() to use AWS_LAMBDA_FUNCTION_NAME only (was probing two env vars; divergent from sister binary).
• A2#1 / A3#3 (HIGH) — Moved defer r.Body.Close() to handler entry so the error path still releases the body.
• A3#4 (MEDIUM) — Wrapped body read with http.MaxBytesReader (512 KB) to defend the local HTTP path against pathological dev requests; Stripe caps webhook payloads at ~256 KB.
• A2#6 (LOW) — Renamed localWebhookPath → webhookPath (the path applies in both transports, not just local).
• A2#8 (LOW) — Used http.StatusBadRequest constant instead of magic 400.
• A2#3, A2#4, A2#5, A2#9 (LOW) — Trimmed unnecessary comments + inlined a one-line silentLogger() test helper.

What's NOT in this PR (deferred to a dedicated refactor)

The /simplify Code Reuse review flagged that this PR introduces the second cmd binary in the repo, which is the natural inflection point to:

1. Graduate cmd/account-api's open-coded helpers (mustEnv, mustPgxPool, port resolution, IsLambda, JSON response writer) into internal/shared/config/ and internal/shared/httputil/ so both binaries call into one place.
2. Extract fakeVerifier + fakeStore from internal/account/webhook/router_test.go into a internal/account/webhook/webhooktest/ subpackage shared between that test and this new cmd/account-webhook/main_test.go.

That's a cross-binary cleanup with its own scope and review surface — opening as a separate PR per the project's "separate PRs per component" convention. This PR's value (unblocking local webhook testing) doesn't depend on it.

Verification

go vet ./...                  → clean
go build ./...                → clean
go test ./...                 → all packages pass
go test ./cmd/account-webhook → 5 new tests pass

🤖 Generated with Claude Code