[billing] #3 Pre-parser route hook (core)

[PierreBrisorgueil]

Context

Stripe webhooks need raw body for signature verification. The global express.json() and lusca() CSRF must be bypassed for webhook routes.

Scope

• lib/services/express.js: add initPreParserRoutes(app) called before express.json() and lusca()
• New glob in config/assets.js: modules/*/routes/*.preroute.js
• Pre-parser routes are mounted without body parser or CSRF

Acceptance criteria

• A .preroute.js route receives raw body (Buffer)
• Normal routes still get parsed JSON
• CSRF still applies to normal routes
• No regression on existing modules

Dependencies

None (independent core change)