SAMPLE EVIDENCE for PM-03 (made-up app Tidyhaus; not a real review)

stripe-webhook/index.ts, lines 40-52: the plan is set only after event.type == 'checkout.session.completed' and session.payment_status == 'paid', using the service key on the server.