feat(migrate): bundle money guards and identity check (S3 slice 1)

[ABB65]

Follow-up to #404 (t6's non-blocking findings) plus the types bump.

• @contentrain/types 1.45.0 (renewal_cents); the local extra type is gone.
• Supabase auth branch: ensureUserForProviderAccount refuses (IdentityConflictError) an email account already signed in with a different GitHub account, same guard as the managed pair.
• Polar cannot expire or cancel a checkout (no such API), so a re-quote cannot close the old one. Instead: the webhook carries the subscription's checkoutId; a second subscription for a grant that already has one logs [migrate-bundle] ALARM duplicate payment … refund it and is not bound or moved; a payment from a non-current checkout is honoured but logs ALARM stale checkout paid. An unchanged price already reuses the open checkout (S2), so two payable checkouts exist only when the price changed.
• Reconciler: a redeemed bundle with no subscription id raises an ALARM.
• Orphan checkout cleanup: not needed, Polar expires them itself.

Refund of a flagged payment is the ops command in (e) (t5).

Local: lint 0 errors, typecheck 0, unit 1997 pass (run with --testTimeout=90000; the machine was loaded), integration 486, nuxt 274.

[ABB65]

t6 review @ 206ec7f — CHANGES REQUESTED (1 blocker), rest OK

Local evidence at this head: targeted unit (3 files, 33 tests) pass, billing-webhook integration (40 tests) pass, eslint on changed files clean, vue-tsc --noEmit clean. CI ci job was still pending when I posted; postgres-lineage pass.

Blocker — duplicate-payment subscription is still stored as the workspace's active account.
In subscription.created, upsertPaymentAccount runs before redeemMigrateGrant. When the grant is already redeemed, redeemMigrateGrant returns early with the ALARM, but the duplicate subscription is already the workspace's active payment account. The refund the alarm asks for then fires subscription.canceled, which matches that account's subscription id, archives it and sets the workspace plan to free, so the customer's legitimate bundle gets downgraded. Fix: check the grant state first and skip (or park) the account upsert for a duplicate/stale checkout, or have the cancel path ignore subscriptions that never became the redeemed one. Add a webhook-ordering test (duplicate created, then canceled, workspace plan stays).

Non-blocking

• mapSupabaseUser.providerAccountId = user_metadata.provider_id reflects the last sign-in provider, so IdentityConflictError can false-positive when that id belongs to another provider. Consider keying on (provider, id) from identities.
• Current tests do not cover the webhook ordering above.

Re-ping me after the fix and I will re-review the delta quickly.

[ABB65]

t6 delta review @ 0464111 — ONAY (pending green CI)

Blocker fixed: isDuplicateBundleSubscription runs before the account upsert in subscription.created and .updated; a duplicate logs the ALARM and writes no account, so refunding it cannot cancel the valid plan. The Supabase branch now reads auth.identities for the provider instead of user_metadata.provider_id. The webhook-order integration test covers created-duplicate then canceled (no upsert, no redeem, no workspace update).

Local evidence at this head: unit (migrate-bundle-subscription + supabase-auth-provider) 22/22, billing-webhook integration 41/41, eslint on delta files clean, vue-tsc --noEmit clean. Not run: the full pnpm test:ci. The ci and postgres-lineage jobs were still pending at post time; merge only when they are green.

Known residual (non-blocking): a duplicate created event that lands before the first subscription is redeemed is not detectable (redeemed id still null); the reconciler/alarm path covers it.