Add freemium access economy and token store

ENVIRONMENTS.md

@@ -18,10 +18,20 @@ The existing `KUBECONFIG` secret is shared. Configure these environment-specific
 - `UAT_MONGODB_CONNECTION_STRING` and `PRD_MONGODB_CONNECTION_STRING`
 - `UAT_AUTH_JWT_KEY` and `PRD_AUTH_JWT_KEY` (different values)
 - `UAT_INTERNAL_PURGE_SECRET` and `PRD_INTERNAL_PURGE_SECRET`
-- `UAT_STRIPE_SECRET_KEY` and `UAT_STRIPE_WEBHOOK_SECRET` (Stripe sandbox)
-- `PRD_STRIPE_SECRET_KEY` and `PRD_STRIPE_WEBHOOK_SECRET` (Stripe live mode)
+- `UAT_STRIPE_SECRET_KEY`, `UAT_STRIPE_WEBHOOK_SECRET`, and
+  `UAT_STRIPE_ACCESS_WEBHOOK_SECRET` (Stripe sandbox)
+- `PRD_STRIPE_SECRET_KEY`, `PRD_STRIPE_WEBHOOK_SECRET`, and
+  `PRD_STRIPE_ACCESS_WEBHOOK_SECRET` (Stripe live mode)
 
-Use independent Stripe webhook endpoints for `https://us3q.ranaze.com/api/donations/stripe-webhook` and `https://s3q.ranaze.com/api/donations/stripe-webhook`. No Stripe publishable key is required for hosted Checkout.
+Configure four independent Stripe webhook endpoints:
+
+- UAT donations: `https://us3q.ranaze.com/api/donations/stripe-webhook`
+- UAT access: `https://us3q.ranaze.com/api/access/stripe-webhook`
+- PRD donations: `https://s3q.ranaze.com/api/donations/stripe-webhook`
+- PRD access: `https://s3q.ranaze.com/api/access/stripe-webhook`
+
+Each endpoint has its own signing secret. UAT uses Stripe test mode and PRD uses
+Stripe live mode. No Stripe publishable key is required for hosted Checkout.
 
 ## Initial UAT database migration
 
@@ -67,7 +77,8 @@ The hostname change creates a new browser origin, so testers should expect to si
    db.Users.updateOne({Username: "SUPER"}, {$set: {Role: "SUPER"}})
    ```
 
-7. Configure and test the live Stripe webhook and Steam callback before announcing PRD.
+7. Configure and test both live Stripe webhooks and the Steam callback before
+   announcing PRD.
 
 ## Question promotion behavior