… + billing.go plan_frequency (P2)

Adds the three yearly plan variants to plans.yaml and threads a new
plan_frequency field through POST /api/v1/billing/checkout. Limits +
features on each *_yearly plan mirror the monthly counterpart byte-for-byte;
only price (annual amount in cents) and billing_period: yearly differ.

## Pricing
  hobby_yearly: $90/yr   (~$7.50/mo,  saves $18/yr  vs $9  x 12)
  pro_yearly:   $490/yr  (~$40.83/mo, saves $98/yr  vs $49 x 12)
  team_yearly:  $1990/yr (~$165.83/mo, saves $398/yr vs $199 x 12)

## API changes
- `checkoutRequest.PlanFrequency` ("monthly" | "yearly", default monthly).
  Empty stays back-compat with pre-P2 dashboard clients.
- `razorpayPlanIDFor(tier, frequency)` resolves the right plan_id from
  config. Yearly env vars empty -> 503 billing_not_configured (so partial
  rollout — monthly live, yearly plans not yet created on Razorpay — is
  safe).
- `planIDToTier()` recognises both monthly and yearly plan_ids and maps
  them back to the canonical (bare) tier. teams.plan_tier always stores
  the canonical name so limits resolution is cycle-agnostic.
- Webhook unchanged in shape — the upgrade tier comes from the resolved
  canonical tier regardless of which cycle paid.
- OpenAPI schema documents plan_frequency on /api/v1/billing/checkout.

## New env vars (operator action — see PR body callout)
  RAZORPAY_PLAN_ID_HOBBY_YEARLY
  RAZORPAY_PLAN_ID_PRO_YEARLY
  RAZORPAY_PLAN_ID_TEAM_YEARLY

## Tests
- Unit: 5 new handler tests (invalid_frequency 400, yearly unconfigured
  503, monthly default behaviour, team-tier guard fires on both cycles,
  webhook plan_id -> canonical tier mapping for all 6 plan_ids).
- Unit: 3 new plans tests (yearly variants mirror monthly, CanonicalTier
  helper, base-tier limits unchanged).
- `make test-unit`: green across all packages.

## Dependency
Requires `InstaNode-dev/common#pricing/p2-annual-plans` (PR #6) — adds
the `BillingPeriod` Plan field, the `Registry.BillingPeriod` method,
the `CanonicalTier` helper, and the three yearly entries in the
embedded defaultYAML. This api branch's `go.mod` `replace` directive
points to `../common` so local builds work, but the merged base in
`common` must be cut before this PR lands.