Closes Wave 1. /billing/subscribe (POST, authed) creates a Razorpay subscription for the user's chosen tier. /billing/webhook (POST, HMAC-SHA256 verified) updates User.tier on subscription.charged / subscription.cancelled. Repeat OAuth login already preserves tier (P26).
Tests: subscribe-happy-path, webhook tier-set on charged, webhook tier-clear on cancelled, bad-signature 400.
Closes Wave 1.
/billing/subscribe(POST, authed) creates a Razorpay subscription for the user's chosen tier./billing/webhook(POST, HMAC-SHA256 verified) updatesUser.tieronsubscription.charged/subscription.cancelled. Repeat OAuth login already preserves tier (P26).Tests: subscribe-happy-path, webhook tier-set on charged, webhook tier-clear on cancelled, bad-signature 400.