fix(stripe): guard invalid webhook tolerance config

[aiirvizionz]

Summary

• Keep Stripe webhook timestamp tolerance enforcement active when config receives invalid numeric values.
• Preserve the existing explicit { webhookToleranceSeconds: 0 } escape hatch for disabling timestamp checks.
• Add a regression test showing NaN falls back to the default tolerance instead of bypassing stale-signature protection.

Validation

• git diff --check

I attempted pnpm vitest run packages/payments/stripe/src/index.test.ts and pnpm --filter @profullstack/sh1pt-payment-stripe typecheck, but this checkout stops during dependency preparation because the committed lockfile fails the active supply-chain policy: @profullstack/autoblog@0.4.0 has no tarball integrity field. I did not modify the lockfile; the regression test is included for maintainers' normal CI/runtime.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.