fix(migrate): revoking an already ended subscription is success

[ABB65]

What

t6 note 2 on #406: subscriptions.revoke throws for a subscription Polar already ended, so the revoke endpoint looped on 502 with the grant still live.

• PaymentProvider.cancelSubscription returns 'canceled' | 'already_ended'; Polar maps AlreadyCanceledSubscription / ResourceNotFound to already_ended, anything else still throws.
• Revoke marks the grant revoked and answers subscription_canceled:false (no 502, jti kept used).

Tests

Route test for the already-ended case; plugin tests for canceled / already_ended (both errors) / other failure rethrown. Unit, delete-routes and billing-webhook integration, eslint, typecheck green.

[ABB65]

t6 review @ a89c436 — ONAY (merge when the ci job is green; it was pending when I posted, postgres-lineage pass)

Local evidence at this head: --project unit 182 files / 2015 tests, integration 52 / 487, nuxt 43 / 274 pass; eslint on changed files and vue-tsc --noEmit clean.

What I checked:

• The error shape is real, not just a mock: in @polar-sh/sdk@0.47.0 AlreadyCanceledSubscription and ResourceNotFound both set this.error to their literal name, and subscriptionsRevoke lists both in its error union. kind === 'AlreadyCanceledSubscription' || 'ResourceNotFound' matches the SDK's own classes.
• A real outage is not treated as success: every other error (SDK ConnectionError, timeout, SubscriptionLocked, validation, plain Error) has no matching .error literal and is rethrown, so the route still answers 502, leaves the grant live and gives the jti back. Pinned by "still throws any other provider failure" and the existing 502 route test.
• Already-ended case: grant is marked revoked, subscription_canceled:false, jti not released. Stripe provider keeps 'canceled'; the other caller (workspaces/[workspaceId]/index.delete.ts) ignores the return value.

Note (non-blocking): ResourceNotFound also covers a subscription id Polar cannot find because the token points at the wrong Polar organisation or environment (sandbox vs production). That would mark the grant revoked while the real subscription lives on. Not reachable with correct config, but worth keeping in mind when the production token is set.