mrhid6andClaude Opus 5
fbd93d0ea5
Client is a thin REST client (net/http) rather than the vendor SDK: the surface we need is two calls, and a hand-rolled client has no version-drift risk and no dependency in go.sum. All Paddle wire shapes live only in http.go. PADDLE_API_KEY and PADDLE_WEBHOOK_SECRET are boot-required — an unverified webhook endpoint is one anyone can issue licences through. paddle_events carries a unique index on event_id for webhook idempotency. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>