fix(billing): add stripe_subscription_id fallback to prevent silent cancellation drop on customer drift

[bokelley]

Closes #4170

Adds a stripe_subscription_id DB fallback to resolveOrgForStripeCustomer to prevent silent cancellation drops in the customer-drift scenario. Also adds logger.warn + notifySystemError alerting for unresolvable .updated/.deleted events, and a regression test covering the drift scenario end-to-end.

Root cause (not captured by the three hypotheses in the issue): resolveOrgForStripeCustomer had no lookup keyed on stripe_subscription_id. When the event's customer field didn't match any org's stripe_customer_id AND the subscription had no workos_organization_id metadata (pre-dates metadata-stamping), the resolver returned null — the DB UPDATE was silently skipped while Stripe got a 200 and never retried. The StripeCustomerConflictError path (hypothesis 1) and isStaleNonLiveEvent guard (hypothesis 2) were both red herrings.

Changes:

• server/src/db/organization-db.ts — adds getOrganizationByStripeSubscriptionId (mirrors getOrganizationByStripeCustomerId; uses existing unique partial index from migration 013)
• server/src/billing/webhook-helpers.ts — adds step 3.5: direct sub-ID DB lookup when all metadata paths miss; updates JSDoc lookup-order list
• server/src/http.ts — adds logger.warn + notifySystemError when org resolution fails for .updated/.deleted so ops is alerted immediately rather than discovering via manual sweep
• server/tests/unit/webhook-org-resolution.test.ts — adds drift regression test (conflict and no-conflict variants)

Non-breaking justification: new read-only DB method + new resolver fallback path; existing call sites and consumer behaviour are unaffected. No schema, protocol, or API reference changes; changeset is --empty.

Nit (noted, not fixed): The step 3.5 fallback is unreachable for invoice.paid drift scenarios because those call sites don't pass a subscription object. Pre-existing gap, not a regression introduced here. Follow-up: thread subscription into the invoice resolver or extend step 3.5 to resolve from invoice.subscription.

Pre-PR review:

• code-reviewer: approved — no blockers; JSDoc updated, happy-path test added; invoice.paid gap noted as latent follow-up
• internal-tools-strategist: approved — fix proportionate, closes access-control gap; uniqueness constraint confirmed in migration 013; --empty changeset confirmed correct

Triage-managed PR. This bot does not currently iterate on
review comments or PR conversation threads (only on the source
issue). To unblock:

• Push fixup commits directly: gh pr checkout <num> →
  fix → push.
• Or re-trigger: comment /triage execute on the source
  issue.

See #3121
for context.

Session: https://claude.ai/code/session_017UQZCzNYrKnhBJKWUpBCcT

---

Generated by Claude Code