referrals: close D.3 — both parties get 45 days credit on conversion

The referral feature was half-built: codes captured, banner shown,
counts displayed — but no money flowed when a referred user paid.
The Settings page hard-coded "— (D.3)" for Active credits and the
marketing copy promised "50% off for 3 months" with nothing behind it.

Closing the loop:

- New `convert_referral(session, user)` in referral_service.py looks
  up the user's Referral row, stamps `converted_at` + `credited_at`,
  and extends `credit_until` by 45 days on BOTH the buyer and the
  referrer. Idempotent — replayed webhooks and renewals are no-ops.
  Stacks correctly when the user already has a credit window running
  (anchors at max(now, current_credit_until) like cli.grant_credit).

- Stripe webhook wires this into `_grant_paid`. A captured
  `first_paid_transition = user.tier != "paid"` gate avoids the DB
  lookup on every renewal event; convert_referral's own idempotency
  is the second line of defence.

- `_grant_paid` now takes `session` as its first positional arg so
  the conversion runs inside the same transaction as the tier flip
  and audit-row write. A mid-flight failure rolls everything back
  together — no partial state.

- Settings page replaces the "— (D.3)" placeholder with the live
  count of conversions still inside their 45-day credit window, plus
  a "+N days on your account" hint when the user has any credit of
  their own (referrer bonus, admin grant, or future refund-as-credit).

- Marketing copy on pricing.html + settings.html switches from "50%
  off for 3 months" to "45 days of paid access" — same economic value,
  honest about the actual mechanism (full free access rather than
  discounted billing).

Credit-amount rationale: 50% × 3 months ≈ 1.5 months of free
service ≈ 45 days. Pure-credit delivery is processor-agnostic, needs
no Stripe coupon plumbing, and stacks cleanly across referrals.

7 new tests in test_referral_conversion.py cover the happy path,
idempotency, no-referral no-op, credit stacking, deleted-referrer
survival, end-to-end webhook → credit landing, and the renewal-event
no-double-credit guarantee.

Also bundled: the Restore-button class fix from earlier
(portfolio.js — the cloud-restore "Restore" submit was unstyled and
picked up browser defaults; now uses .settings-btn like the rest of
the action-button family).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

app/templates/pricing.html

@@ -212,9 +212,9 @@
   <div class="invite-callout__icon" aria-hidden="true">&#x1F381;</div>
   <div class="invite-callout__body">
     <div class="invite-callout__eyebrow">Invite a friend</div>
-    <div class="invite-callout__headline">Both of you get <strong>50% off for 3 months</strong></div>
+    <div class="invite-callout__headline">Both of you get <strong>45 days of paid access</strong></div>
     <div class="invite-callout__sub">
-      Share your personal invite link from <a href="/settings">Settings</a>. The discount applies when they start a paid plan.
+      Share your personal invite link from <a href="/settings">Settings</a>. The credit applies when they start a paid plan.
     </div>
   </div>
   <button type="button" class="btn-secondary" id="invite-more">How it works</button>
@@ -227,20 +227,21 @@
     Every account gets an 8-character referral code and matching invite
     link, both shown on your <a href="/settings">Settings</a> page. When
     someone signs up through your link and starts a paid plan,
-    <strong>both of you get 50% off for the next three months</strong>.
+    <strong>both of you get 45 days of paid access</strong> credited
+    to your account.
   </p>
   <h3 class="text-modal__head">How it works</h3>
   <ol class="text-modal__list">
     <li><strong>Sign up.</strong> Your code and link go live in Settings.</li>
     <li><strong>Share.</strong> Send the link, or read the code &mdash; the alphabet drops <code>0/O</code> and <code>1/I/L</code> so it dictates cleanly.</li>
     <li><strong>They sign up.</strong> The referral is recorded against your account when they verify their email.</li>
-    <li><strong>They subscribe.</strong> The discount applies to their next bill and credits against yours.</li>
+    <li><strong>They subscribe.</strong> 45 days of paid access lands on both accounts &mdash; usable any time over the next month and a half.</li>
   </ol>
   <h3 class="text-modal__head">The fine print</h3>
   <ul class="text-modal__list">
     <li>One referral per new account &mdash; whichever link they used first.</li>
     <li>No self-referral.</li>
-    <li>The credit ledger is live today; the cash value kicks in when paid checkout opens. Referrals logged in the meantime are honoured.</li>
+    <li>Credits stack: if you already have a credit window running, the new 45 days extend from its end, not from today.</li>
     <li>Credits aren&rsquo;t refundable for cash &mdash; see <a href="/terms">Terms &amp; Conditions &sect; 6</a>.</li>
     <li>Pending signups, conversions, and active credits are visible on the Settings page.</li>
   </ul>

app/templates/settings.html

@@ -121,7 +121,8 @@
       <summary class="settings-section__head">Invite a friend</summary>
       <p class="settings-section__lede">
         Share your invite link. When your friend subscribes, you and
-        they each get <strong>50% off for 3 months</strong>.
+        they each get <strong>45 days of paid access</strong> credited
+        to your account.
       </p>
 
       <div class="invite-block">
@@ -146,7 +147,12 @@
         </div>
         <div>
           <div class="invite-stats__label">Active credits</div>
-          <div class="invite-stats__value settings-row__hint">— (D.3)</div>
+          <div class="invite-stats__value">{{ active_credit_count }}</div>
+          {% if own_credit_days %}
+            <div class="settings-row__hint" style="margin-left:0;">
+              +{{ own_credit_days }} day{{ '' if own_credit_days == 1 else 's' }} on your account
+            </div>
+          {% endif %}
         </div>
       </div>
     </details>