Replaced session-cookie auth with JWT bearer tokens across the request pipeline. New AuthMiddleware validates RS256 signatures.
Implemented sliding-window rate limiter using Redis. Applied to /charge, /refund, and /webhook routes with configurable thresholds.
Updated webhook payload structure to match Stripe API v2 event format. Added backward-compatible envelope wrapper.
Resolved race condition where concurrent retries could generate duplicate charge records. Added SHA-256 based idempotency hashing.
Refactored GitHub Actions workflow to support parallel staging and production deploy tracks. Added smoke test gate before promotion.