fix stripe for production

scripts/docker-prod-common.sh

@@ -181,7 +181,7 @@ EOF
 }
 
 validate_prod_env_file() {
-  local acme_email api_domain public_site_domain cors_origins portainer_domain postgres_password redis_password jwt_secret
+  local acme_email api_domain public_site_domain cors_origins portainer_domain postgres_password redis_password jwt_secret stripe_api_key stripe_webhook_secret
 
   acme_email="$(read_env_value ACME_EMAIL)"
   api_domain="$(read_env_value API_DOMAIN)"
@@ -191,6 +191,8 @@ validate_prod_env_file() {
   postgres_password="$(read_env_value POSTGRES_PASSWORD)"
   redis_password="$(read_env_value REDIS_PASSWORD)"
   jwt_secret="$(read_env_value JWT_SECRET)"
+  stripe_api_key="$(read_env_value STRIPE_API_KEY)"
+  stripe_webhook_secret="$(read_env_value STRIPE_WEBHOOK_SECRET)"
 
   if [[ -z "${acme_email}" || "${acme_email}" != *@* || "${acme_email}" == *example.com* ]]; then
     echo "Invalid ACME_EMAIL in ${ENV_FILE}. Set it to a real contact email for Let's Encrypt, not example.com." >&2
@@ -221,6 +223,25 @@ validate_prod_env_file() {
     fi
   done
 
+  if [[ -z "${stripe_api_key}" || "${stripe_api_key}" == placeholder || "${stripe_api_key}" == replace-with-* || "${stripe_api_key}" == *changeme* || "${stripe_api_key}" == *change-me* ]]; then
+    echo "Invalid STRIPE_API_KEY in ${ENV_FILE}. Set a real Stripe secret or restricted API key for production billing." >&2
+    exit 1
+  fi
+
+  if [[ "${stripe_api_key}" != sk_* && "${stripe_api_key}" != rk_* ]]; then
+    echo "Invalid STRIPE_API_KEY in ${ENV_FILE}. It must start with sk_ or rk_." >&2
+    exit 1
+  fi
+
+  if [[ -z "${stripe_webhook_secret}" || "${stripe_webhook_secret}" == placeholder || "${stripe_webhook_secret}" == replace-with-* || "${stripe_webhook_secret}" == *changeme* || "${stripe_webhook_secret}" == *change-me* ]]; then
+    echo "Invalid STRIPE_WEBHOOK_SECRET in ${ENV_FILE}. Set the Stripe webhook signing secret for /api/v1/subscriptions/webhooks/stripe." >&2
+    exit 1
+  fi
+
+  if [[ "${stripe_webhook_secret}" != whsec_* ]]; then
+    echo "Invalid STRIPE_WEBHOOK_SECRET in ${ENV_FILE}. It must start with whsec_." >&2
+    exit 1
+  fi
 
   if [[ -n "${portainer_domain}" && "${portainer_domain}" == *example.com* ]]; then
     echo "Invalid PORTAINER_DOMAIN in ${ENV_FILE}. Set a real hostname or disable the portainer router." >&2