fix: strip polar_whs_ prefix from webhook secret before base64 decode

src/lib/payments/polar.ts

@@ -70,10 +70,11 @@ export function verifyPolarWebhook(
 
   const signedContent = `${webhookId}.${webhookTimestamp}.${rawBody}`;
 
-  // Secret base64 olabilir
+  // Polar secret: "polar_whs_<base64>" — prefix soyulup base64 decode edilir
   let secretBytes: Buffer;
   try {
-    secretBytes = Buffer.from(WEBHOOK_SECRET.replace(/^whsec_/, ""), "base64");
+    const raw = WEBHOOK_SECRET.replace(/^(whsec_|polar_whs_)/, "");
+    secretBytes = Buffer.from(raw, "base64");
   } catch {
     secretBytes = Buffer.from(WEBHOOK_SECRET);
   }