Grant mobile plans from verified App Store and Play purchases (#78) (#79)

## Summary
- Mobile access is granted by `POST /api/finance/store/confirm/` after the app finishes a StoreKit or Play Billing purchase.
- App Store signed transactions are checked against Apple Root CA G3. Play purchase tokens are checked with the Play Developer API.
- The RevenueCat webhook no longer grants a plan. Stripe Checkout and the Stripe webhook stay for the website.
- A purchase account token must match the signed-in user, and a transaction already linked to another account is rejected. Access ends when the verified period end passes unless the app confirms again.

Client: ai_ml_operations/chat_web_app#122

## Config
- `APPLE_IAP_BUNDLE_ID` (default `ai.hesychia.chat`)
- `GOOGLE_PLAY_PACKAGE_NAME`
- `GOOGLE_PLAY_SERVICE_ACCOUNT_JSON` (JSON or a file path)
- Plan `revenuecat_product_id` or `REVENUECAT_PRODUCT_PLAN_MAP` maps the store product to a plan

## Test plan
- [x] `python manage.py test monetization.tests.test_store_purchases monetization.tests.test_revenuecat monetization.tests.test_plans_quotas`
- [ ] Confirm an App Store sandbox transaction and a Play license-test purchase against a configured backend
- [ ] Confirm a token already linked to another user is rejected
- [ ] Confirm `GET /subscription/` returns `store_account_token` and flips a lapsed store sub to canceled

Reviewed-on: #79

.env.example

@@ -83,8 +83,12 @@ STRIPE_WEBHOOK_SECRET=
 # Optional: pre-created Stripe Price ID for Founders. When empty, Checkout uses
 # SubscriptionPlan.price_cents / SUBSCRIPTION_PRICE_* ($10 USD / month Founders).
 STRIPE_PRICE_ID=
-# RevenueCat webhook Authorization bearer secret (store IAP).
-REVENUECAT_WEBHOOK_SECRET=
+# Native store purchases (#78). iOS verifies the StoreKit signed transaction
+# against Apple Root CA G3. Android calls the Play Developer API.
+APPLE_IAP_BUNDLE_ID=ai.hesychia.chat
+GOOGLE_PLAY_PACKAGE_NAME=ai.hesychia.chat
+# Service-account JSON (one line) or a path to the JSON file. Empty disables Play confirm.
+GOOGLE_PLAY_SERVICE_ACCOUNT_JSON=
 # Optional JSON map of store product id → plan slug, e.g.
 # REVENUECAT_PRODUCT_PLAN_MAP={"hesychia_founders_monthly":"founders"}
 # SUBSCRIPTION_PRICE_AMOUNT_CENTS=1000