Phase 5 billing: account-based annual sub + tag SKUs + SMS pool + tag lifecycle

- Schema: plans, orders subscription cols + plan_id + period_started_at,
  billing_events log, users.stripe_id + sms_credits, products.price_aud
  (db/schema.sql + Laravel migration, idempotent)
- Laravel/Cashier: Billable User, checkout (annual sub + one-off SKUs with
  Managed Payments tax_code), webhook controller (signature-verified,
  idempotent, BILLING_ENABLED kill-switch), account tag transitions,
  nightly reconcile, Stripe portal link, PlanResource + billing dashboard
- Go frontend: account-level gating (paid sub required), SMS pool
  (included 50/yr + credits, drawn after included), plan caps replace
  constants, 60s plan cache (credits fresh), 25-tag cap (plan max_tags)
- BillingSeeder: personal plan + 3 SKUs + dev paid orders
- Verified test-mode e2e: subscribe/paid/active/alerts, pool exhaust +
  credits resume, lapsed/suspended, cancelled/closed, recover/active,
  webhook idempotency, 25-cap, one-off SKUs, replacement, kill-switch,
  invalid signature 400

admin/app/routes/console.php

@@ -2,7 +2,11 @@
 
 use Illuminate\Foundation\Inspiring;
 use Illuminate\Support\Facades\Artisan;
+use Illuminate\Support\Facades\Schedule;
 
 Artisan::command('inspire', function () {
     $this->comment(Inspiring::quote());
 })->purpose('Display an inspiring quote');
+
+// Nightly billing drift guard (webhook miss recovery).
+Schedule::command('wherewoof:reconcile-subscriptions')->dailyAt('03:00');

admin/app/routes/web.php

@@ -4,3 +4,13 @@ use Illuminate\Support\Facades\Route;
 
 // Admin root -> the Filament panel.
 Route::redirect("/", "/admin");
+
+// Billing: Stripe checkout sessions (annual subscription + one-off SKUs).
+Route::middleware(['web'])->group(function () {
+    Route::get('/billing/subscribe', [App\Http\Controllers\StripeBillingController::class, 'subscribe'])->name('billing.subscribe');
+    Route::get('/billing/buy/{sku}', [App\Http\Controllers\StripeBillingController::class, 'buy'])->name('billing.buy');
+});
+
+// Stripe webhook: signature-verified, CSRF-exempt (Stripe does not send CSRF tokens).
+Route::post('/webhooks/stripe', [App\Http\Controllers\StripeWebhookController::class, 'handle'])
+    ->withoutMiddleware([\Illuminate\Foundation\Http\Middleware\VerifyCsrfToken::class]);