fix(billing): pm_type/pm_last_four migration, narrow CSRF exclusion, EU paper size

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

bootstrap/app.php

@@ -17,7 +17,7 @@ return Application::configure(basePath: dirname(__DIR__))
         ]);
 
         $middleware->validateCsrfTokens(except: [
-            'stripe/*',
+            'stripe/webhook',
         ]);
     })
     ->withExceptions(function (Exceptions $exceptions): void {

config/cashier.php

@@ -108,7 +108,7 @@ return [
 
         'options' => [
             // Supported: 'letter', 'legal', 'A4'
-            'paper' => env('CASHIER_PAPER', 'letter'),
+            'paper' => env('CASHIER_PAPER', 'A4'),
 
             'remote_enabled' => env('CASHIER_REMOTE_ENABLED', false),
         ],

database/migrations/2026_05_15_300004_add_payment_method_columns_to_workspaces_table.php

@@ -0,0 +1,29 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('workspaces', function (Blueprint $table) {
+            $table->string('pm_type', 25)->nullable()->after('stripe_id');
+            $table->string('pm_last_four', 4)->nullable()->after('pm_type');
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('workspaces', function (Blueprint $table) {
+            $table->dropColumn(['pm_type', 'pm_last_four']);
+        });
+    }
+};

tests/Feature/Billing/StripeWebhookTest.php

@@ -5,8 +5,6 @@ it('handles subscription_created webhook', function () {
     // With an invalid Stripe-Signature header, Cashier returns 403 (AccessDeniedHttpException).
     config(['cashier.webhook.secret' => 'whsec_test_dummy_secret']);
 
-    $workspace = \App\Domains\Workspace\Models\Workspace::factory()->create();
-
     $payload = [
         'type' => 'customer.subscription.created',
         'data' => [