Fix 5 critical issues: provisioning storage, webhook auth, password exposure, middleware, model conflict

- Store VirtFusion provisioning info in credentials column instead of non-existent provisioning_info key
- Add PayPal webhook header verification to reject unsigned requests
- Stop exposing VPS root password in flash message, use separate new_password key
- Apply ensure_not_suspended middleware to account routes
- Rename User::invoices() to billingInvoices() to avoid overriding Cashier's invoices() method

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

website/app/Models/User.php

@@ -61,7 +61,7 @@ class User extends Authenticatable implements MustVerifyEmail
     }
 
     /** @return HasMany<\App\Models\Invoice, $this> */
-    public function invoices(): HasMany
+    public function billingInvoices(): HasMany
     {
         return $this->hasMany(Invoice::class);
     }