stripe: detect buyer currency at checkout (GBP/USD/EUR)

Pass `currency` to Stripe checkout for first-time buyers so Stripe
picks the matching `currency_options` rate configured on the Price
in the Dashboard (multi-currency Prices: one Price, per-currency
unit_amount). Operator configures the rates on existing Prices
prod_UaZ0xCpCboUGCN/price_*; this commit is the application-side
signal.

Currency precedence: explicit request body > Cloudflare cf-ipcountry
header > Accept-Language locale > GBP fallback. Only honoured when
the user has no stripe_customer_id yet — Stripe locks currency to
the customer record at first checkout, so existing customers keep
their original currency (they can switch via the portal).

Adds 4 tests: sniffed currency on new customer, body override beats
sniff, currency omitted for existing customer, and unit-tests for
the sniffing fallback chain.

app/routers/stripe_billing.py

@@ -19,7 +19,7 @@ from __future__ import annotations
 
 import asyncio
 import json
-from typing import Any, Literal
+from typing import Any, Literal, Optional
 
 import stripe
 from fastapi import APIRouter, Body, Depends, HTTPException, Request
@@ -69,6 +69,53 @@ def _price_for(cadence: str) -> str:
     raise HTTPException(status_code=400, detail="cadence must be 'monthly' or 'annual'")
 
 
+# Rough country → currency mapping. Covers the markets we have a stated
+# rate for; everything else falls back to GBP (the home currency) and
+# Stripe handles the FX at checkout. Configure the per-currency
+# unit_amount on each Price's `currency_options` in the Stripe Dashboard
+# — we just signal which option to use here.
+_COUNTRY_CURRENCY: dict[str, str] = {
+    "US": "usd", "CA": "usd",
+    "GB": "gbp", "IM": "gbp", "JE": "gbp", "GG": "gbp",
+    **dict.fromkeys((
+        "DE", "FR", "IT", "ES", "PT", "NL", "BE", "IE", "AT", "FI",
+        "GR", "LU", "MT", "CY", "EE", "LV", "LT", "SI", "SK", "HR",
+    ), "eur"),
+}
+
+# Accept-Language locale → currency, used when CF-IPCountry is absent.
+# Ambiguous locales (e.g. plain "fr" without region) get EUR because
+# that's the majority outcome.
+_LOCALE_CURRENCY: dict[str, str] = {
+    "en-gb": "gbp", "en": "gbp",
+    "en-us": "usd", "en-ca": "usd",
+    "fr": "eur", "de": "eur", "it": "eur", "es": "eur",
+    "pt": "eur", "nl": "eur",
+}
+
+
+def _sniff_currency(request: Request) -> str:
+    """Best-effort currency detection for new-customer checkouts.
+
+    Order: explicit Cloudflare country header, then Accept-Language
+    (exact match then language-only). GBP as the final fallback. Only
+    consulted when the user has no Stripe customer record yet — Stripe
+    locks currency at customer creation, so an existing customer's
+    currency wins regardless of the request locale.
+    """
+    cc = (request.headers.get("cf-ipcountry") or "").upper()
+    if cc in _COUNTRY_CURRENCY:
+        return _COUNTRY_CURRENCY[cc]
+    al = (request.headers.get("accept-language") or "").lower()
+    first = al.split(",", 1)[0].split(";", 1)[0].strip()
+    if first in _LOCALE_CURRENCY:
+        return _LOCALE_CURRENCY[first]
+    short = first.split("-", 1)[0]
+    if short in _LOCALE_CURRENCY:
+        return _LOCALE_CURRENCY[short]
+    return "gbp"
+
+
 def _stripe_client() -> stripe.StripeClient:
     """Per-call client so we read the secret at request time (lets us
     rotate the key by editing .env + reloading without rebuilding any
@@ -83,6 +130,10 @@ def _stripe_client() -> stripe.StripeClient:
 
 class CheckoutRequest(BaseModel):
     cadence: Literal["monthly", "annual"]
+    # Optional override; when omitted we sniff from request headers.
+    # Honoured only for first-time checkouts (Stripe locks currency
+    # to the customer at creation).
+    currency: Optional[Literal["gbp", "usd", "eur"]] = None
 
 
 class CheckoutResponse(BaseModel):
@@ -92,6 +143,7 @@ class CheckoutResponse(BaseModel):
 @router.post("/api/stripe/checkout", response_model=CheckoutResponse)
 async def create_checkout(
     body: CheckoutRequest,
+    request: Request,
     session: AsyncSession = Depends(get_session),
     cu: CurrentUser = Depends(require_auth),
 ) -> CheckoutResponse:
@@ -120,6 +172,13 @@ async def create_checkout(
         # referral redemption flow ships.
         "allow_promotion_codes": True,
     }
+    # Multi-currency: for first-time buyers (no stripe_customer_id yet)
+    # we pass the detected/requested currency. Stripe picks the matching
+    # `currency_options` rate configured on the Price in the Dashboard,
+    # then locks that currency to the new customer record. Existing
+    # customers keep their original currency regardless.
+    if not user.stripe_customer_id:
+        create_kwargs["currency"] = body.currency or _sniff_currency(request)
     # Per-cadence cooling-off treatment:
     #
     # - Annual gets a 14-day free trial. No money moves during the