Billing: Checkout trial, promotion codes, and verified purchase tracking

[paulocastellano]

Context

Split out of #204. Cashier/checkout slice — merge-safe without Onboarding.

Goal

Replace the $1 first-month coupon with a Stripe Checkout trial + optional promotion codes, and harden purchase tracking so only verified conversions fire.

In scope

• ConfigureSubscriptionCheckout (trial days from CASHIER_TRIAL_DAYS, clamp to Stripe minimums; CASHIER_ALLOW_PROMOTION_CODES)
• Remove FirstMonthCheckoutDiscount
• Wire StartSubscriptionCheckout / cashier config / .env.example
• /billing/processing purchase tracking:
  • Verify Checkout Session belongs to the account’s Stripe customer
  • Completed-session-only conversion data
  • Idempotent / ack-safe delivery (no pixel on foreign or invented session ids)
• Billing i18n for processing copy as needed

Critical out of scope (independence)

• Do not redirect owners to the post-subscription /onboarding checklist yet — keep processing → current main destination (e.g. app/calendar/accounts). The Onboarding module owns flipping that redirect when the checklist exists.
• Welcome UI / ICP rename
• MCP / residual banner

Independence

Safe to merge to main alone. Checkout behavior improves; post-checkout destination stays stable until Onboarding ships.

Suggested test plan

• Trial length / promo flags respected; CASHIER_TRIAL_DAYS=0 charges immediately
• qualifiesForCheckoutTrial edge cases (first-time, incomplete_expired, etc.)
• Foreign / invalid / abandoned / transient Stripe sessions never fire purchase
• Processing recovers across reload without double-firing
• Post-checkout still lands on the current destination (not checklist)

[paulocastellano]

Closing as won't do for now.

We're keeping the $1 first-month checkout discount — it's converting well (~3–4 organic sales/day) and still helps cut fake signups / Stripe risk. Replacing it with a native Checkout trial + promotion codes isn't worth the change right now.

Purchase-tracking hardening (if we still want it later) can be a small standalone issue; it doesn't block #222 or #239.