Stripe webhook signatures: verify against the raw body (Next.js App Router and Express)

# Stripe webhook signatures: use the raw body

`stripe.webhooks.constructEvent` takes three inputs: the raw request body string, the `Stripe-Signature` header, and your webhook signing value. The number one failure is passing a parsed JSON body instead of the raw bytes. Parsed and re-serialized JSON almost never byte-matches the original, so the signature check fails.

## Next.js App Router

Route handlers receive a standard Web Request. Call `.text()` to get the untouched body:

```
import Stripe from 'stripe';
const stripe = new Stripe(process.env.STRIPE_API_KEY_VALUE);

export async function POST(request) {
  const rawBody = await request.text();
  const sig = request.headers.get('stripe-signature');
  const signingValue = process.env.STRIPE_WEBHOOK_SIGNING_VALUE;
  let event;
  try {
    event = stripe.webhooks.constructEvent(rawBody, sig, signingValue);
  } catch (err) {
    return new Response('bad signature', { status: 400 });
  }
  // handle event.type ...
  return new Response('ok', { status: 200 });
}
```

Do not call `request.json()` before this. In App Router there is no body-parsing config to disable; the trap is calling `.json()` first out of habit.

## Express

Register a raw-body route before any JSON middleware touches it:

```
app.post('/webhooks/stripe',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const sig = req.headers['stripe-signature'];
    let event;
    try {
      event = stripe.webhooks.constructEvent(req.body, sig, signingValue);
    } catch (err) {
      return res.status(400).send('bad signature');
    }
    // handle event.type ...
    res.sendStatus(200);
  });
```

If `express.json()` runs first globally, `req.body` is already parsed and verification fails. Scope the raw middleware to the webhook route.

## Checklist

- Signing value comes from the webhook endpoint settings in the Dashboard, not the API key.
- Compare against the raw bytes exactly as Stripe sent them.
- Return 400 on failure, 200 only after the event is accepted.
- This differs from the existing Lambda webhook skill: same Stripe rule, different framework traps.