Add webhook logging, pagination, middleware, migrations, and prod hardening

- Webhook event logging repo and subscription webhook idempotency
- Pagination helper (echohelpers) with cursor/offset support
- Request ID and structured logging middleware
- Push client improvements (FCM HTTP v1, better error handling)
- Task model version column, business constraint migrations, targeted indexes
- Expanded categorization chain tests
- Email service and config hardening
- CI workflow updates, .gitignore additions, .env.example updates

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/repositories/subscription_repo.go

@@ -57,12 +57,19 @@ func (r *SubscriptionRepository) Update(sub *models.UserSubscription) error {
 	return r.db.Save(sub).Error
 }
 
-// UpgradeToPro upgrades a user to Pro tier
+// UpgradeToPro upgrades a user to Pro tier using a transaction with row locking
+// to prevent concurrent subscription mutations from corrupting state.
 func (r *SubscriptionRepository) UpgradeToPro(userID uint, expiresAt time.Time, platform string) error {
-	now := time.Now().UTC()
-	return r.db.Model(&models.UserSubscription{}).
-		Where("user_id = ?", userID).
-		Updates(map[string]interface{}{
+	return r.db.Transaction(func(tx *gorm.DB) error {
+		// Lock the row for update
+		var sub models.UserSubscription
+		if err := tx.Set("gorm:query_option", "FOR UPDATE").
+			Where("user_id = ?", userID).First(&sub).Error; err != nil {
+			return err
+		}
+
+		now := time.Now().UTC()
+		return tx.Model(&sub).Updates(map[string]interface{}{
 			"tier":          models.TierPro,
 			"subscribed_at": now,
 			"expires_at":    expiresAt,
@@ -70,18 +77,27 @@ func (r *SubscriptionRepository) UpgradeToPro(userID uint, expiresAt time.Time,
 			"platform":      platform,
 			"auto_renew":    true,
 		}).Error
+	})
 }
 
-// DowngradeToFree downgrades a user to Free tier
+// DowngradeToFree downgrades a user to Free tier using a transaction with row locking
+// to prevent concurrent subscription mutations from corrupting state.
 func (r *SubscriptionRepository) DowngradeToFree(userID uint) error {
-	now := time.Now().UTC()
-	return r.db.Model(&models.UserSubscription{}).
-		Where("user_id = ?", userID).
-		Updates(map[string]interface{}{
+	return r.db.Transaction(func(tx *gorm.DB) error {
+		// Lock the row for update
+		var sub models.UserSubscription
+		if err := tx.Set("gorm:query_option", "FOR UPDATE").
+			Where("user_id = ?", userID).First(&sub).Error; err != nil {
+			return err
+		}
+
+		now := time.Now().UTC()
+		return tx.Model(&sub).Updates(map[string]interface{}{
 			"tier":         models.TierFree,
 			"cancelled_at": now,
 			"auto_renew":   false,
 		}).Error
+	})
 }
 
 // SetAutoRenew sets the auto-renew flag