Charge for store items, and price them individually

The store had 26 items, a price on each and a working equip flow, but the
purchase endpoint granted ownership without taking any money. Anyone signed
in could take the whole catalogue for nothing. That endpoint is now gone.

Payment goes through Stripe Checkout, which is hosted by Stripe. The buyer is
redirected there and comes back, so no card details reach this server and it
stays outside PCI scope.

Three rules hold the money path together:

- The price comes from the server's own catalogue row. The client sends an
  item id and never an amount.
- Nothing is granted at checkout. The item appears only when a webhook
  arrives with a valid HMAC-SHA256 signature, checked in constant time
  against a 5 minute timestamp window.
- Fulfilment keys off the processor's session id, which is UNIQUE, so a
  webhook delivered twice cannot grant the same item twice.

Prices now vary by item. Every caret cost the same as every other because
they are the same thing in a different colour, which left nothing to save
for. Carets run 149 to 349, flair 129 to 299, and sprites 249 to 399, since a
sprite is the one cosmetic every other racer sees.

Four bundles sit above the catalogue, each priced below the sum of its parts:
Starter Kit, Neon Set, Racer Set and The Lot. The saving is computed from the
current item prices rather than asserted, so it cannot drift. The Lot is
defined as every cosmetic rather than a fixed list, so it stays complete as
items are added.

Three bugs found while wiring this up:

- Sprites never showed as equipped. The store compared the equipped caret and
  flair but not the sprite.
- Supporter status was a stored boolean that was set on payment and never
  cleared, so a 30 day subscription lasted forever. Both read paths now
  derive it from the expiry.
- sqlx::migrate! reads the migrations directory at compile time, but cargo
  watches source files only. Adding a migration did not trigger a rebuild, so
  the binary shipped the old migration set and the schema change never ran.
  A build.rs now declares the dependency.

Verified against a real database: bundle maths, the grant statement and its
replay, 401 unauthenticated, 404 on unknown ids, 501 with no Stripe keys, and
both already-owned refusals.

1 files changed, 16 insertions, 0 deletions

diff --git a/README.md b/README.md
index 615a2ec..595b0e6 100755
--- a/README.md
+++ b/README.md
@@ -160,6 +160,22 @@ Migrations run at startup. Configuration is by environment variable; see
 | `TEXTS_JSON_PATH` | Dataset the race passages come from |
 | `SPOTIFY_CLIENT_ID` | Spotify application ID, for Lyrics mode |
 | `SPOTIFY_CLIENT_SECRET` | Spotify application secret |
+| `STRIPE_SECRET_KEY` | Stripe API key, for the store |
+| `STRIPE_WEBHOOK_SECRET` | Signing secret for the Stripe webhook |
+
+### Store
+
+The store sells cosmetics and a supporter subscription. Checkout is hosted by
+Stripe: the buyer is redirected there, pays there, and returns. No card
+details reach this server.
+
+Nothing is granted at checkout. Stripe calls `/api/billing/webhook` when the
+payment succeeds, the server verifies the signature, and only then does the
+item appear. Set both Stripe variables. With either one missing, the store
+still displays but every checkout answers 501.
+
+Prices come from the `cosmetics` and `bundles` tables. The client sends an
+item id, never an amount.
 
 ## Deployment