Payments & Enrollments
- Create session
- POST /api/checkout/create-session builds Stripe line items; adds courseIds in metadata; uses APP_BASE_URL for redirects
- Webhook
- POST /api/stripe/webhook verifies signature and upserts Enrollment records (idempotent via unique composite key)
- Verify
- GET /api/checkout/verify-session to confirm paid/completed state client-side
