Add Stripe billing, free trials, and cross-platform subscription guards

- Stripe integration: add StripeService with checkout sessions, customer
  portal, and webhook handling for subscription lifecycle events.
- Free trials: auto-start configurable trial on first subscription check,
  with admin-controllable duration and enable/disable toggle.
- Cross-platform guard: prevent duplicate subscriptions across iOS, Android,
  and Stripe by checking existing platform before allowing purchase.
- Subscription model: add Stripe fields (customer_id, subscription_id,
  price_id), trial fields (trial_start, trial_end, trial_used), and
  SubscriptionSource/IsTrialActive helpers.
- API: add trial and source fields to status response, update OpenAPI spec.
- Clean up stale migration and audit docs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/integration/kmp_contract_test.go

@@ -98,6 +98,10 @@ var specEndpointsKMPSkips = map[routeKey]bool{
 	{Method: "POST", Path: "/notifications/devices/"}:         true, // KMP uses /notifications/devices/register/
 	{Method: "POST", Path: "/notifications/devices/unregister/"}: true, // KMP uses DELETE on device ID
 	{Method: "PATCH", Path: "/notifications/preferences/"}:    true, // KMP uses PUT
+	// Stripe web-only and server-to-server endpoints — not implemented in mobile KMP
+	{Method: "POST", Path: "/subscription/checkout/"}:         true, // Web-only (Stripe Checkout)
+	{Method: "POST", Path: "/subscription/portal/"}:           true, // Web-only (Stripe Customer Portal)
+	{Method: "POST", Path: "/subscription/webhook/stripe/"}:   true, // Server-to-server (Stripe webhook)
 }
 
 // kmpRouteAliases maps KMP paths to their canonical spec paths.

internal/integration/security_regression_test.go

@@ -76,7 +76,7 @@ func setupSecurityTest(t *testing.T) *SecurityTestApp {
 	taskHandler := handlers.NewTaskHandler(taskService, nil)
 	contractorHandler := handlers.NewContractorHandler(services.NewContractorService(contractorRepo, residenceRepo))
 	notificationHandler := handlers.NewNotificationHandler(notificationService)
-	subscriptionHandler := handlers.NewSubscriptionHandler(subscriptionService)
+	subscriptionHandler := handlers.NewSubscriptionHandler(subscriptionService, nil)
 
 	// Create router with real middleware
 	e := echo.New()

internal/integration/subscription_is_free_test.go

@@ -64,7 +64,7 @@ func setupSubscriptionTest(t *testing.T) *SubscriptionTestApp {
 	// Create handlers
 	authHandler := handlers.NewAuthHandler(authService, nil, nil)
 	residenceHandler := handlers.NewResidenceHandler(residenceService, nil, nil, true)
-	subscriptionHandler := handlers.NewSubscriptionHandler(subscriptionService)
+	subscriptionHandler := handlers.NewSubscriptionHandler(subscriptionService, nil)
 
 	// Create router
 	e := echo.New()