Add subcription feature

STRIPE_TESTING_GUIDE.md

@@ -242,7 +242,21 @@ Your application validates the `PILOT2025` coupon code and, when valid:
    - Schedules the first invoice for day 91
    - Automatically begins normal billing after trial ends
 
-**IMPORTANT:** You do NOT need to create a coupon in Stripe Dashboard. The coupon is managed entirely in your application's database. Stripe only needs to know about the trial period duration (90 days).
+**IMPORTANT:** You do NOT need to create a coupon in Stripe Dashboard. The coupon is managed entirely in your application's database.
+
+**How it works with Stripe:**
+- Your application validates the `PILOT2025` coupon code against your database
+- If valid, your backend passes `trial_period_days=90` parameter when creating the Stripe subscription
+- Stripe doesn't know about the "PILOT2025" coupon itself - it only receives the trial duration
+- Example API call to Stripe:
+  ```python
+  stripe.Subscription.create(
+      customer=customer_id,
+      items=[{"price": price_id}],
+      trial_period_days=90,  # <-- This is what Stripe needs
+      # No coupon parameter needed in Stripe
+  )
+  ```
 
 #### Verify PILOT2025 Coupon in Your Database:
 
@@ -308,12 +322,34 @@ The backend coupon configuration is managed in code at [services/tenant/app/jobs
 
 ### Step 3: Configure Webhooks
 
-1. Navigate to **Developers** → **Webhooks**
+**Important:** For local development, you'll use **Stripe CLI** instead of creating an endpoint in the Stripe Dashboard. The CLI automatically forwards webhook events to your local server.
+
+#### For Local Development (Recommended):
+
+**Use Stripe CLI** - See [Webhook Testing Section](#webhook-testing) below for detailed setup.
+
+Quick start:
+```bash
+# Install Stripe CLI
+brew install stripe/stripe-cli/stripe  # macOS
+
+# Login to Stripe
+stripe login
+
+# Forward webhooks to gateway
+stripe listen --forward-to https://bakery-ia.local/api/v1/stripe
+```
+
+The CLI will provide a webhook signing secret. See the [Webhook Testing](#webhook-testing) section for complete instructions on updating your configuration.
+
+#### For Production or Public Testing:
+
+1. Navigate to **Developers** → **Webhooks** in Stripe Dashboard
 2. Click **+ Add endpoint**
 
-3. **For Local Development:**
-   - Endpoint URL: `https://your-ngrok-url.ngrok.io/webhooks/stripe`
-   - (We'll set up ngrok later for local testing)
+3. **Endpoint URL:**
+   - Production: `https://yourdomain.com/api/v1/stripe`
+   - Or use ngrok for testing: `https://your-ngrok-url.ngrok.io/api/v1/stripe`
 
 4. **Select events to listen to:**
    - `checkout.session.completed`
@@ -1080,8 +1116,13 @@ This opens a browser to authorize the CLI.
 
 #### Step 3: Forward Webhooks to Local Server
 
+**For Development with Stripe CLI:**
+
+The Stripe CLI creates a secure tunnel to forward webhook events from Stripe's servers to your local development environment.
+
 ```bash
-stripe listen --forward-to localhost:8000/webhooks/stripe
+# Forward webhook events to your gateway (which proxies to tenant service)
+stripe listen --forward-to https://bakery-ia.local/api/v1/stripe
 ```
 
 **Expected Output:**
@@ -1089,10 +1130,28 @@ stripe listen --forward-to localhost:8000/webhooks/stripe
 > Ready! Your webhook signing secret is whsec_abc123... (^C to quit)
 ```
 
-**Important:** Copy this webhook signing secret and add it to your backend `.env`:
-```bash
-STRIPE_WEBHOOK_SECRET=whsec_abc123...
-```
+**Important - Update Your Configuration:**
+
+1. **Copy the webhook signing secret** provided by `stripe listen`
+
+2. **Encode it for Kubernetes:**
+   ```bash
+   echo -n "whsec_abc123..." | base64
+   ```
+
+3. **Update secrets.yaml:**
+   ```bash
+   # Edit infrastructure/kubernetes/base/secrets.yaml
+   # Update the STRIPE_WEBHOOK_SECRET with the base64 value
+   ```
+
+4. **Apply to your cluster:**
+   ```bash
+   kubectl apply -f infrastructure/kubernetes/base/secrets.yaml
+   kubectl rollout restart deployment/tenant-service -n bakery-ia
+   ```
+
+**Note:** The webhook secret from `stripe listen` is temporary and only works while the CLI is running. Each time you restart `stripe listen`, you'll get a new webhook secret.
 
 #### Step 4: Trigger Test Events