Validate webhook payloads before processing to prevent bad data

Stripe sends a webhook. Before processing, need to verify: signature is valid, required fields exist, amounts are reasonable, timestamp is recent. One bad webhook can corrupt your database.