feat(revenue): Stripe refunds and net revenue tiles

[mlava]

Summary

The one-off product row on the Revenue page now reports refunds — prompted by a live test order that was refunded and still showed as $9 revenue.

• New client methods: listRefunds(created[gte]) and getOneOffPurchaseByPaymentIntent; sessions now carry their payment_intent.
• Refunds (succeeded only) are attributed to the one-off product through the PaymentIntent → Checkout Session join, with a capped (20) per-refund session lookup for refunds whose purchase predates the 60-day sessions window.
• UI: the one-off row grows to four tiles — Purchases, Gross revenue, Refunds (lower is better), Net revenue — all last-30 vs prior-30. Refund windows use the refund's created date (a July refund of a June purchase is a July refund).
• Graceful degradation: a STRIPE_SECRET_KEY without the Refunds → Read grant gets the old gross-only tiles plus a hint, not an error. Docs updated (.env.example, setup card, spec 0014).
• get_stripe_revenue MCP output includes refunds/net (or notes the missing grant).

Testing

• 15 unit tests pass (new: refund windowing; PI-based attribution incl. lookup fallback and cross-product rejection); tsc, oxlint, Prettier clean.

🤖 Generated with Claude Code