tests: Harden billing webhooks and usage reporting

[nishantmonu51]

Harden billing provider input, delivery, and checkpoint behavior.

• reject oversized, malformed, stale, or incorrectly signed webhook requests
• support repeated or comma-combined Orb signatures during secret rotation
• return retryable failures when durable queue insertion fails
• avoid panics on malformed Stripe previous-attribute shapes
• verify stable Orb event identity, batching boundaries, and retry classification
• keep final usage checkpoints behind durable runtime and admin-derived metrics
• make reporter time and dependencies deterministic for failure-path tests

Validation:

• go test -short -race -count=1 -timeout=15m ./admin/billing ./admin/billing/payment ./admin/jobs/river

Checklist:

• Covered by tests
• Ran it and it works as intended
• Reviewed the diff before requesting a review
• Checked for unhandled edge cases
• Linked the issues it closes
• Checked if the docs need to be updated. No documentation update is required.
• Intend to cherry-pick into the release branch
• I am proud of this work!

[nishantmonu51]

Temporarily closing to keep the first review wave focused. We will reopen this PR after #9730, #9731, and #9732 have merged. The branch is being retained.