Add Apple/Google IAP validation and subscription webhooks

- Add Apple App Store Server API integration for receipt/transaction validation
- Add Google Play Developer API integration for purchase token validation
- Add webhook endpoints for server-to-server subscription notifications
  - POST /api/subscription/webhook/apple/ (App Store Server Notifications v2)
  - POST /api/subscription/webhook/google/ (Real-time Developer Notifications)
- Support both StoreKit 1 (receipt_data) and StoreKit 2 (transaction_id)
- Add repository methods to find users by transaction ID or purchase token
- Add configuration for IAP credentials (APPLE_IAP_*, GOOGLE_IAP_*)
- Add setup documentation for configuring webhooks

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

internal/router/router.go

@@ -119,6 +119,9 @@ func SetupRouter(deps *Dependencies) *gin.Engine {
 	subscriptionService := services.NewSubscriptionService(subscriptionRepo, residenceRepo, taskRepo, contractorRepo, documentRepo)
 	taskTemplateService := services.NewTaskTemplateService(taskTemplateRepo)
 
+	// Initialize webhook handler for Apple/Google subscription notifications
+	subscriptionWebhookHandler := handlers.NewSubscriptionWebhookHandler(subscriptionRepo, userRepo)
+
 	// Initialize middleware
 	authMiddleware := middleware.NewAuthMiddleware(deps.DB, deps.Cache)
 
@@ -169,6 +172,9 @@ func SetupRouter(deps *Dependencies) *gin.Engine {
 		// Public data routes (no auth required)
 		setupPublicDataRoutes(api, residenceHandler, taskHandler, contractorHandler, staticDataHandler, subscriptionHandler, taskTemplateHandler)
 
+		// Subscription webhook routes (no auth - called by Apple/Google servers)
+		setupWebhookRoutes(api, subscriptionWebhookHandler)
+
 		// Protected routes (auth required)
 		protected := api.Group("")
 		protected.Use(authMiddleware.TokenAuth())
@@ -433,3 +439,13 @@ func setupMediaRoutes(api *gin.RouterGroup, mediaHandler *handlers.MediaHandler)
 		media.GET("/completion-image/:id", mediaHandler.ServeCompletionImage)
 	}
 }
+
+// setupWebhookRoutes configures subscription webhook routes for Apple/Google server-to-server notifications
+// These routes are public (no auth) since they're called by Apple/Google servers
+func setupWebhookRoutes(api *gin.RouterGroup, webhookHandler *handlers.SubscriptionWebhookHandler) {
+	webhooks := api.Group("/subscription/webhook")
+	{
+		webhooks.POST("/apple/", webhookHandler.HandleAppleWebhook)
+		webhooks.POST("/google/", webhookHandler.HandleGoogleWebhook)
+	}
+}