Stripe is connected by pasting one key: checkout and the customer portal run over fetch, with nothing to set up in Stripe's dashboard #11136

Why. The lowest barrier: the owner pastes a key and can sell. Zero dependencies: fetch and Web Crypto only.

What. src/billing/stripe.ts, the stripe provider of the Billing seam.

• The admin Billing page takes a Stripe secret or restricted key and seals it with the forge's secrets (src/core/secret_store.ts). A sk_test_/rk_test_ key shows the word sandbox beside the provider on every admin billing view; a live key shows live.
• On connect, the forge registers its own webhook endpoint (POST /v1/webhook_endpoints, url <forge>/hooks/stripe, events: checkout.session.completed, customer.subscription.updated, customer.subscription.deleted, invoice.paid, invoice.payment_failed) and seals the returned signing secret. Disconnect removes the endpoint. A key without that permission is told so in plain words, with a field to paste a signing secret instead.
• checkout: POST /v1/checkout/sessions, mode=subscription, one line item with inline price_data (currency=usd, unit_amount from the plan, recurring[interval]=month, product_data[name] = the plan's name), client_reference_id = the order id, metadata[order], metadata[plan], the same two under subscription_data[metadata], customer_email, success_url, cancel_url, allow_promotion_codes=true. No Product or Price is created by hand.
• portal: POST /v1/billing_portal/sessions with the stored customer.
• reconcile: GET /v1/subscriptions/{id}; active/trialing → active, past_due → grace, canceled/unpaid/incomplete_expired → none.
• Wire rules: Authorization: Bearer, application/x-www-form-urlencoded with bracketed nested keys, a pinned Stripe-Version header (one constant), an Idempotency-Key on every POST derived from the order id.
• api.stripe.com is a declared vendor the forge process may call (docs/CLOUD.md, mayUse); nothing else is opened.

Acceptance. Tests run against a fake fetch and assert the exact form bodies and headers; no network in tests. The key never appears in a log, an error, argv or a page. docs/PROFIT.md says how to connect Stripe in five lines.