PROTECTED DOWNLOAD SPECIFICATION

Suggested server fields:
stripe_checkout_session_id UNIQUE
stripe_payment_intent_id
customer_email
token_hash UNIQUE
product_version
created_at
expires_at
used_at NULL
status

Rules:
1. Create entitlement only after server-side verified successful Stripe payment.
2. Webhook fulfillment must be idempotent.
3. Generate a cryptographically random token; store its hash where practical.
4. Expire entitlement 24 hours after issuance.
5. Permit one successful product download.
6. Keep product outside the public web root.
7. Never expose Stripe secret keys or webhook secrets in browser code.
8. HTTPS only.