Harden billing and metering for the live launch
- Refuse mixed Stripe key modes (sk/rk vs pk vs STRIPE_WEBHOOK_MODE) at boot and ignore webhook events whose livemode mismatches the secret key. - BILLING_CHECKOUT_DISABLED kill switch: checkouts answer 503, the portal only updates the card, webhooks keep processing. - invoice.paid recovers past_due subscriptions; past_due past PAST_DUE_GRACE_DAYS (default 14) meters as Free. - Disputes matching no account notify site admins. - Pro gets a $50 default spending limit when none is set; withinSpendingLimit and spendGuard share one reach-but-not-exceed boundary in microcents (limit 0 no longer blocks included usage). - Platform-wide daily AI cost ceiling (AI_DAILY_SPEND_CEILING_CENTS, fail closed) checked before every non-BYOK call; ai.tokens is now reserved and settled instead of read-only checked. - Storage gauge writes take an atomic hold so concurrent writes cannot both pass the cap (BILL-P9). - Metering refuses disabled billed accounts (and so members' work on disabled orgs). - Docs: billing.md, metering.md, release-checklist-billing.md.
33 files changed+904−125
Rendering diff…