polar: build /api/polar/webhook handler

Standalone router for inbound Polar (merchant-of-record) deliveries.
No bearer-token dep — authenticity comes from the Standard Webhooks
HMAC instead. Wired up so it's safe to deploy dark: empty
POLAR_WEBHOOK_SECRET makes the endpoint return 503 (loud) rather than
accept unsigned events.

Behaviour
- Standard Webhooks signature verification: HMAC-SHA256 over
  `{webhook-id}.{webhook-timestamp}.{body}`, base64 secret prefixed
  whsec_, ±5min replay window, constant-time compare against any of
  the space-separated v1 tokens.
- Idempotency via UNIQUE on polar_events.event_id — a replayed
  webhook-id short-circuits to 200 "duplicate" without re-running.
- Event dispatch table covers the 10 events we subscribed to:
  subscription.{created,active,updated,uncanceled} -> tier=paid +
  persist polar_customer_id / polar_subscription_id.
  subscription.revoked -> tier=free (customer id kept so a resub
  matches the same User row).
  canceled / past_due / order.* / refund.created -> audit only.
- Unknown event types are acked 200 + recorded; we don't want to 4xx
  on something Polar adds in the future and trigger their retry loop.

Schema (migration 0018)
- users.polar_customer_id, users.polar_subscription_id (both nullable
  String(64)); UNIQUE on polar_customer_id so two users can't claim
  the same Polar identity.
- polar_events table: event_id (unique), event_type, received_at,
  processed_at, error, raw payload (truncated to 16 KiB).

Tests
- 7 in tests/test_polar_webhook.py: bad signature -> 401, stale
  timestamp -> 401, missing headers -> 400, subscription.active flips
  tier to paid + stores IDs, subscription.revoked drops to free while
  keeping customer link, replayed webhook-id is no-op, unknown event
  is acked.
- Full suite: 212 passed, 5 skipped.

Operator next steps before saving the webhook in Polar
1. Pull this branch to prod and apply migration 0018.
2. Save the webhook in Polar pointing at
   https://read.markets/api/polar/webhook — Polar will accept the
   save even though our endpoint still 503s (no secret yet).
3. Copy the secret Polar reveals into the prod .env as
   POLAR_WEBHOOK_SECRET=whsec_... and restart the app.
4. Trigger a test event from Polar's dashboard to confirm 200 OK.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

app/main.py

@@ -21,6 +21,7 @@ from app.routers import api as api_router
 from app.routers import auth as auth_router
 from app.routers import email as email_router
 from app.routers import pages as pages_router
+from app.routers import polar_webhook as polar_webhook_router
 from app.routers import public as public_router
 from app.routers import sync as sync_router
 from app.routers import universe as universe_router
@@ -88,6 +89,10 @@ app.include_router(email_router.router, tags=["email"])
 app.include_router(api_router.router, prefix="/api", tags=["api"])
 app.include_router(universe_router.router, prefix="/api", tags=["universe"])
 app.include_router(sync_router.router, tags=["portfolio-sync"])
+# Polar webhook (no bearer-token auth — authenticity via HMAC). Path
+# `/api/polar/webhook` is set on the route itself so the URL Polar
+# stores remains stable even if api_router's prefix ever moves.
+app.include_router(polar_webhook_router.router, tags=["polar-webhook"])
 # Public router (no auth dep) before pages_router so the marketing/legal
 # paths can never collide with future authenticated routes.
 app.include_router(public_router.router)