add Paddle webhook auto-setup, ngrok tunnel, and clean DB on each dev run

setup_paddle.py creates a notification destination in Paddle and writes
the webhook secret + setting ID to .env. dev_run.sh resets the DB, seeds
data, and starts an ngrok tunnel to update the webhook URL automatically
for end-to-end checkout testing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

CHANGELOG.md

@@ -11,8 +11,14 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   checks prerequisites, installs deps, creates `.env` with auto-generated
   `SECRET_KEY`, runs migrations, seeds test data, optionally sets up Paddle
   sandbox products, and builds CSS
-- **Dev run script** (`scripts/dev_run.sh`) — starts app, worker, and CSS
-  watcher in parallel with colored/labeled output and clean Ctrl-C shutdown
+- **Dev run script** (`scripts/dev_run.sh`) — resets DB, runs migrations, seeds
+  data, builds CSS, then starts app + worker + CSS watcher in parallel with
+  colored/labeled output and clean Ctrl-C shutdown; when Paddle is configured
+  and ngrok is installed, starts a tunnel and updates the Paddle webhook
+  destination automatically for end-to-end checkout testing
+- **Paddle webhook auto-setup** — `setup_paddle.py` now creates a notification
+  destination in Paddle with the 5 event types the webhook handler processes,
+  and writes `PADDLE_WEBHOOK_SECRET` to `.env` automatically
 - **Resend test email docs** — documented Resend test addresses
   (`delivered@resend.dev`, `bounced@resend.dev`, etc.) in `.env.example` and
   README for testing email flows without a verified domain