widgori widget worker

routes:
  GET  /w/{embedToken}           render a widget (or its lock screen)
  POST /w/{embedToken}/api       widget data api
  POST /webhooks/stripe          Stripe billing (signature required)
  GET  /internal/entitlement     private origin fallback (shared secret)
  POST /billing/checkout         create a Checkout Session (Supabase JWT)
  POST /billing/portal           Stripe Customer Portal (Supabase JWT)
  GET  /billing/status           poll entitlement after checkout
  GET  /dashboard/catalog        live templates (Supabase JWT)
  GET  /dashboard/widgets        list instances (Supabase JWT)
  POST /dashboard/widgets        mint instance + embed token in one transaction
  POST /dashboard/widgets/:id/upgrade  pin a newer template edition (opt-in)
  GET  /health                   liveness check

local dev: `npm run seed` prints ready-made test URLs.