fix(payment): critical fixes from agent audit

- Fix CreateOrderResult field names (snake_case → camelCase to match backend)
- Fix MethodLimits JSON tags to consistent snake_case
- Fix Stripe webhook header case sensitivity (lowercase keys for map lookup)
- Fix MaxAmount=0 backend validation (0 = no limit, not reject all)
- Fix structured error for INVALID_AMOUNT per CLAUDE.md spec

backend/internal/handler/payment_webhook_handler.go

@@ -4,6 +4,7 @@ import (
 	"io"
 	"log/slog"
 	"net/http"
+	"strings"
 
 	"github.com/Wei-Shaw/sub2api/internal/payment"
 	"github.com/Wei-Shaw/sub2api/internal/service"
@@ -70,7 +71,7 @@ func (h *PaymentWebhookHandler) handleNotify(c *gin.Context, providerKey string)
 
 	headers := make(map[string]string)
 	for k := range c.Request.Header {
-		headers[k] = c.GetHeader(k)
+		headers[strings.ToLower(k)] = c.GetHeader(k)
 	}
 
 	notification, err := provider.VerifyNotification(c.Request.Context(), string(body), headers)