Add Stripe checkout redirect flow and subscription URL handler

- Backend: Add /api/stripe/redirect endpoint that trampolines from
  https:// to fazm:// custom URL scheme (required by Stripe Checkout)
- Backend: Add payment_method_types[0]=card to checkout params
- Backend: Skip webhook signature check when secret is "placeholder"
- App: Handle fazm://subscription/success URL to refresh status and
  dismiss paywall after successful payment
- App: Remove hardcoded success/cancel URLs from SubscriptionService
  (backend now constructs them using its own redirect endpoint)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: m13v

Desktop/Sources/FazmApp.swift

@@ -973,6 +973,20 @@ class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
             for window in NSApp.windows where window.title.hasPrefix("Fazm") {
                 window.makeKeyAndOrderFront(nil)
             }
+        case "subscription":
+            // Handle subscription success/cancel redirects from Stripe Checkout
+            let path = url.path
+            log("FazmApp: Subscription URL callback: \(path)")
+            NSApp.activate(ignoringOtherApps: true)
+            if path == "/success" {
+                // Refresh subscription status and dismiss paywall
+                Task {
+                    await SubscriptionService.shared.refreshStatus()
+                    await MainActor.run {
+                        PaywallWindowController.shared.close()
+                    }
+                }
+            }
         default:
             log("FazmApp AppDelegate: Unhandled URL path: \(url.host ?? "nil")")
         }

Desktop/Sources/Providers/SubscriptionService.swift

@@ -95,10 +95,9 @@ final class SubscriptionService {
         request.setValue("application/json", forHTTPHeaderField: "Content-Type")
         request.timeoutInterval = 15
 
-        let body: [String: String] = [
-            "success_url": "fazm://subscription/success",
-            "cancel_url": "fazm://subscription/cancel",
-        ]
+        // The backend constructs the actual success/cancel URLs using its own
+        // redirect endpoint, so we don't need to send them from the client.
+        let body: [String: String] = [:]
         request.httpBody = try JSONSerialization.data(withJSONObject: body)
 
         let (data, response) = try await URLSession.shared.data(for: request)