Stripe event: customer.subscription.created, provision only if the status is real

# customer.subscription.created: check status before you provision

A subscription object now exists. That is all this event proves.

## What to do on receipt

1. Read `data.object.status`. Provision only when it is `active` or `trialing`.
2. If status is `incomplete`, the first payment has not succeeded. Do not provision. Stripe will move it to `active` (via `customer.subscription.updated` plus `invoice.payment_succeeded`) or to `incomplete_expired` if payment never lands.
3. If status is `incomplete_expired`, the signup failed outright. Treat it as an abandoned signup, optionally email the customer to retry.
4. On `active` or `trialing`: create the account, grant the plan's entitlements, store the subscription id against your user. Return 200.

## The trap

Provisioning on `created` unconditionally. With default settings, a subscription created with a failing card sits in `incomplete` for up to 23 hours while Stripe retries, and your system just gave a full account to a payment that will never clear. The status field is the whole game.

## Checklist

- `trialing` means provision now with a trial flag, and set a reminder for `customer.subscription.trial_will_end` (3 days before the trial ends) so you are not surprised.
- Map Stripe price ids to your plan tiers in config, not in the handler. The handler reads `data.object.items.data` and looks up the tier.