Stripe Customer Billing Portal session wrapper.
Wraps the processor-level portal_session_create/2 callback,
projects the response into a tightly-typed struct, and masks the
:url field in Inspect output — the portal URL is
a single-use, short-lived (~5 minute) authenticated bearer
credential that impersonates the customer in the Stripe portal.
Any leak via Logger, APM, crash dumps, or telemetry handlers is an
account-takeover vector within the TTL window.
Configuration
Programmatic BillingPortal.Configuration support is deferred to a
future processor release. For now, host apps configure portal
behavior in the Stripe Dashboard (matching the Pay/Cashier
convention) and pass the resulting bpc_* id via the
:configuration option on create/1. See
guides/portal_configuration_checklist.md for the three required
Dashboard toggles that defend against the "cancel-without-dunning"
footgun (Pitfall 6).