feat(membership): implement subscription entitlement and quota backend
- Add User.appAccountToken, StoreProduct, PlanQuota models
- Extend UserMembership with Apple IAP fields + source/status
- Add AppStoreTransaction (immutable) + AppStoreNotification (Durable Inbox)
- Implement EffectiveMembershipService (multi-grant → effectivePlan)
- Implement EffectiveQuotaService (PlanQuota-driven, Legacy/Shadow/Enforced)
- Implement AppStoreJwsVerifier (x5c chain → Apple Root CA G3)
- Implement AppStoreTransactionService (JWS verify + atomic projection)
- Implement AppStoreNotificationService (9 event types + lifecycle)
- Wire QuotaGuard across 5 AI Job types (active_recall/feynman/quiz/learning/flashcard)
- Add Membership API: GET /plans, /me, /usage, POST /apple/transactions
- Add webhook: POST /webhooks/app-store/v2 (@Public)
- Add 11 unit tests for EffectiveMembershipService
- Migration: 3 SQL files (expand_schema, transaction_notification, quotausage_unique)
Co-Authored-By: Claude <noreply@anthropic.com>
9566de63a2