Connect Apple purchases and recovery to Maple account billing

[AnthonyRonning]

This connects the StoreKit bridge in #981 to the normal Maple application. iOS uses Apple-localized monthly Pro/Max pricing, authenticated confirmation, automatic recovery, restore, and subscription management. Other clients list Apple subscriptions and route management to Apple.

Native GitHub Stack #1003: #981 → #1001, with master as the trunk. The separate Maple Dev identity and TestFlight lane are in #998.

Behavior and boundaries

• Each credential revision owns its purchase/recovery work. Logout and deletion suspend it synchronously; refresh creates a fresh owner. Every observed signed revision must be acknowledged before its exact transaction ID can be finished, independently of which provider supplies access.
• Automatic recovery suppresses unchanged HTTP 400/409 submissions per Maple account/API origin across SDK refreshes. Explicit Retry/Restore or new signed transaction state permits another attempt. Independent transactions and transient 429/5xx failures continue with backoff; foreground events do not bypass it. Listener completion reconciles outstanding failures before clearing error feedback.
• Wrapped ownership conflicts retain useful account guidance. Purchase confirmation names the purchased plan as current only when the server selects it.
• Billing tokens remain in memory and are account/revision-bound. Late requests, token mints, checkout redirects, and portal opening cannot reuse a revoked owner. Apple HTTP fetch and body processing have a 30-second deadline.
• The new-purchase flag leaves restore and management available. Team/other-provider conflicts prevent overlapping purchases; unknown or failed status blocks paid checkout. Status lists every subscription, including ones not supplying the selected quota.
• Native iOS hides credit purchase controls, Team seat-purchase prompts, pass entry, and web discount promotions. Existing usage, API keys, Team membership, and cancellation management remain accessible. Existing non-Apple web/desktop/Android purchase paths remain.
• Anonymous Apple purchasers receive account-recovery guidance. This phase introduces no US external-checkout link.

Validation

• Canonical frontend CI and normal pre-commit hooks: 1,163 tests passed, zero failures, formatting, lint, and TypeScript passed; existing lint warnings remain.
• The focused 75-test recovery/paywall suite covers mixed permanent/transient failures, unchanged-conflict suppression through refresh and wake events, explicit recovery, changed signed state, revision overlap, exact finish ordering, listener completion, disposal, safe messages, and selected-plan wording.
• PR-profile web build passed. Distribution tree SHA-256: 8d33ec08f4654554cb2d0ac382cec267b33a702869fdca83b049afe62730b979.
• Independent source review of the correction found no remaining blockers.
• Fresh normal-app iOS 26.5 simulator build 43.3, StoreKit Lab disabled: retained authenticated synthetic Dev session, live subscription status, native Pro $23/month and Max $114.99/month prices, disabled new purchases, Restore → Apple sign-in → cancellation with visible safe feedback, explicit Retry clearing the error without a sign-in sheet, session persistence across relaunch, logout, and a second relaunch remaining signed out. No purchase or Apple transaction acknowledgement is claimed.
• Simulator composite cf5edbf666ad9dc3ab48fbc13c18ffe86c890c67 combines application fix fd960bc5 with Dev lane e219b878. The later PR changes are documentation/test-fixture only, with identical runtime sources. Actual bundle identity cloud.opensecret.maple.dev and embedded Dev profile verified; frontend tree 500ed319cf0223836a937eaa8b8dde68a910623d7a2c04e60540a1b9c22f1c5f.
• Native GitHub Stack registration dispatches CI against the master trunk. Native jobs retain the repository's changed-path selection; a skipped native job is not simulator evidence.

Remaining live gates

Real Apple sandbox purchase → server entitlement/quota → exact finish, purchased restore/reinstall, renewals/grace/refunds/notifications, signed archive/export, and TestFlight processing remain separate validation gates. Xcode-local StoreKit transactions are not valid hosted-billing evidence. Stable Dev web/native OAuth and native Sign in with Apple need their own live validation.

Production purchases remain disabled. Before enablement, account deletion needs a durable OpenSecret-to-billing retirement event; client suspension does not implement it. Team/credit/pass consumption policy remains an App Review/product decision. This PR does not change billing-server/provider accounting or publish to a store.