stripe: wire checkout, customer portal, and webhook for read.markets

Stripe is the merchant-on-record for read.markets after Polar/Paddle
both declined the financial-media category. This commit lands the
full subscription flow: an "Upgrade" button on /pricing now opens a
real Stripe-hosted Checkout, completes the subscription, and the
webhook flips user.tier to "paid" idempotently.

Endpoints
- POST /api/stripe/checkout (require_auth) — creates a hosted
  Checkout Session in subscription mode, passes user.id as
  client_reference_id + email as customer_email, returns the URL
  for the page-side JS to redirect to. Reuses an existing
  stripe_customer_id to avoid duplicate Stripe customers on repeat
  checkouts. allow_promotion_codes=True so the referral-credit
  redemption can attach a coupon at checkout once that flow ships.
- POST /api/stripe/portal (require_auth) — mints a Stripe Customer
  Portal session. Used by /settings; returns 404 until the user has
  a stripe_customer_id (i.e. completed at least one checkout).
- POST /api/stripe/webhook — signature-verified via
  stripe.Webhook.construct_event. Idempotent via UNIQUE on
  stripe_events.event_id. Event dispatch:
    checkout.session.completed       → grant paid, store IDs
    customer.subscription.created    → grant paid (active/trialing)
    customer.subscription.updated    → grant paid (active/trialing)
    customer.subscription.deleted    → drop to free, clear sub id
    invoice.paid / failed            → audit only
    charge.refunded                  → audit only
  Stripe-SDK objects don't expose dict.get(); we use the SDK for
  signature verification then re-parse the JSON body for handler
  dispatch — cleaner than reaching into StripeObject internals.

Schema (migration 0019)
- users.stripe_customer_id, users.stripe_subscription_id (nullable
  String(64), UNIQUE on customer_id).
- stripe_events table mirroring polar_events: event_id (unique),
  event_type, received_at, processed_at, error, raw payload
  (truncated to 16 KiB).

Settings (.env)
- STRIPE_API_KEY            (rk_test_… for dev, rk_live_… for GA)
- STRIPE_WEBHOOK_SECRET     (whsec_… from the dashboard endpoint)
- STRIPE_PRICE_MONTHLY      (price_xxx for £7/month)
- STRIPE_PRICE_ANNUAL       (price_xxx for £70/year)

Pricing page
- Free tier CTA unchanged.
- Paid CTA branches three ways: paid → "Manage subscription" to
  /settings; logged-in free → two buttons (£7/mo, £70/yr) that POST
  to /api/stripe/checkout and redirect; anonymous → /login?next=/pricing.
- Inline JS intercepts the button click, calls the checkout
  endpoint, redirects on success, surfaces errors via alert(). No
  Stripe.js dep — we use the hosted-checkout URL directly.

Polar handler stays in place for berengar.io / flyroom.net which
still ship through Polar. polar_* and stripe_* columns coexist
independently on the User row.

Tests
- 9 in tests/test_stripe_billing.py covering: bad signature → 401,
  missing signature → 400, checkout.session.completed flips tier +
  stores IDs, subscription.updated active grants paid,
  subscription.deleted drops to free with customer id preserved,
  replayed event id is no-op (one row in stripe_events),
  unknown event acked 200, checkout endpoint mocks the SDK and
  returns the hosted URL, checkout requires login.
- Full suite: 221 passed, 5 skipped.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

app/templates/pricing.html

@@ -50,9 +50,8 @@
     <div class="tier-card__tagline">Full-day news feed, hourly strategic log, follow-up chat, and AI portfolio analysis.</div>
     <div class="tier-card__price">&pound;7<span class="tier-card__price-unit"> / month</span></div>
     <div class="tier-card__price-hint">
-      Or <strong>&pound;70 / year</strong> &mdash; two months free. Prices
-      in GBP, VAT where applicable. Checkout opens with the payments
-      rollout.
+      Or <strong>&pound;70 / year</strong> &mdash; two months free.
+      Prices in GBP, VAT where applicable.
     </div>
     <div class="tier-card__divider"></div>
     <div class="tier-card__list-head">Everything in Free, plus</div>
@@ -72,16 +71,56 @@
       or a personal recommendation under FSMA / FCA COBS.
     </p>
     <div class="tier-card__cta">
-      {% if cu and (cu.user or cu.is_admin) %}
-        <a class="btn-secondary btn-block" href="/settings">Manage account</a>
+      {% if paid %}
+        <a class="btn-secondary btn-block" href="/settings">Manage subscription</a>
+      {% elif cu and cu.user %}
+        <button class="btn-primary btn-block" type="button"
+                data-stripe-checkout="monthly">Subscribe &mdash; &pound;7/month</button>
+        <button class="btn-secondary btn-block" type="button"
+                data-stripe-checkout="annual"
+                style="margin-top:10px;">or &pound;70/year (two months free)</button>
       {% else %}
-        <a class="btn-primary btn-block" href="/login">Sign up &mdash; paid unlocks soon</a>
+        <a class="btn-primary btn-block" href="/login?next=/pricing">Sign in to subscribe</a>
       {% endif %}
     </div>
   </div>
 
 </section>
 
+<script>
+(function () {
+  // Wire the two upgrade buttons to /api/stripe/checkout. Stripe returns
+  // a hosted-checkout URL; we just redirect there. No Stripe.js needed.
+  document.querySelectorAll('[data-stripe-checkout]').forEach(function (btn) {
+    btn.addEventListener('click', async function () {
+      var cadence = btn.getAttribute('data-stripe-checkout');
+      btn.disabled = true;
+      var prev = btn.textContent;
+      btn.textContent = 'Opening checkout…';
+      try {
+        var r = await fetch('/api/stripe/checkout', {
+          method: 'POST',
+          headers: {'content-type': 'application/json'},
+          body: JSON.stringify({cadence: cadence}),
+          credentials: 'same-origin',
+        });
+        if (!r.ok) {
+          var detail = '';
+          try { detail = (await r.json()).detail || ''; } catch (e) {}
+          throw new Error('Checkout failed: ' + (detail || r.status));
+        }
+        var data = await r.json();
+        window.location.href = data.url;
+      } catch (e) {
+        alert(e.message || 'Could not start checkout. Please try again.');
+        btn.disabled = false;
+        btn.textContent = prev;
+      }
+    });
+  });
+})();
+</script>
+
 <section class="public-section">
   <h2 class="public-section__head">Free vs Paid at a glance</h2>
   <table class="compare-table">