Admin Stripe invoices + recurring subscriptions (customers pay us) (#24)

## Summary
- Closes #23
- Admin-only invoice dashboard under `/financial/invoices` (superuser)
- One-off Stripe hosted invoices + email pay link (customers pay us)
- Monthly (or weekly/yearly) Stripe Checkout subscriptions + email checkout link
- Webhook at `/financial/stripe/webhook/` syncs invoice/subscription status
- Env docs: `STRIPE_SECRET_KEY`, `STRIPE_PUBLISHABLE_KEY`, `STRIPE_WEBHOOK_SECRET`

## Test plan
- [ ] Set Stripe **test** keys in local `.env` and restart app
- [ ] As superuser: Dashboard → Invoices → create one-off invoice; confirm Stripe invoice + email
- [ ] As superuser: create monthly subscription; open Checkout link; complete with test card `4242…`
- [ ] Configure Stripe CLI or Dashboard webhook → confirm status updates to paid/active
- [ ] Non-admin user cannot open `/financial/invoices`
- [ ] Prod: add live keys + webhook secret to server `.env`, migrate, restart; point webhook to `https://aimloperations.com/financial/stripe/webhook/`

## Notes
Uses stdlib HTTP to Stripe API (no `stripe` PyPI package) so deploys stay dependency-light.Reviewed-on: #24

.env.example

@@ -33,6 +33,13 @@ EMAIL_HOST_USER=
 EMAIL_HOST_PASSWORD=
 EMAIL_PORT=2525
 EMAIL_USE_TLS=true
+# DEFAULT_FROM_EMAIL=AI ML Operations, LLC <info@aimloperations.com>
+
+# Stripe (test keys from https://dashboard.stripe.com/test/apikeys)
+STRIPE_SECRET_KEY=
+STRIPE_PUBLISHABLE_KEY=
+# From `stripe listen` or Dashboard → Developers → Webhooks
+STRIPE_WEBHOOK_SECRET=
 
 # Gunicorn
 GUNICORN_WORKERS=2