v0.8.3 hardening patch

Five correctness fixes, server only. Stripe webhook retry loop closed: failed provisioning events are now retryable instead of silently dropped. Concurrent email flush workers can no longer deliver the same message twice. Object delete ordering corrected — backend delete happens before metadata release, so a failed delete leaves the object in a retryable state. Account ID boundary validation added at storage and account-creation entry points. Witness key startup now auto-corrects broad permissions and aborts if it cannot.

No client update required. No data lost.