Grant mobile plans from verified App Store and Play purchases (#78) (#79)

## Summary
- Mobile access is granted by `POST /api/finance/store/confirm/` after the app finishes a StoreKit or Play Billing purchase.
- App Store signed transactions are checked against Apple Root CA G3. Play purchase tokens are checked with the Play Developer API.
- The RevenueCat webhook no longer grants a plan. Stripe Checkout and the Stripe webhook stay for the website.
- A purchase account token must match the signed-in user, and a transaction already linked to another account is rejected. Access ends when the verified period end passes unless the app confirms again.

Client: ai_ml_operations/chat_web_app#122

## Config
- `APPLE_IAP_BUNDLE_ID` (default `ai.hesychia.chat`)
- `GOOGLE_PLAY_PACKAGE_NAME`
- `GOOGLE_PLAY_SERVICE_ACCOUNT_JSON` (JSON or a file path)
- Plan `revenuecat_product_id` or `REVENUECAT_PRODUCT_PLAN_MAP` maps the store product to a plan

## Test plan
- [x] `python manage.py test monetization.tests.test_store_purchases monetization.tests.test_revenuecat monetization.tests.test_plans_quotas`
- [ ] Confirm an App Store sandbox transaction and a Play license-test purchase against a configured backend
- [ ] Confirm a token already linked to another user is rejected
- [ ] Confirm `GET /subscription/` returns `store_account_token` and flips a lapsed store sub to canceled

Reviewed-on: #79

.env.prod.example

@@ -91,7 +91,9 @@ OAUTH_CALLBACK_BASE_URL=https://chatbackend.aimloperations.com
 STRIPE_SECRET_KEY=replace-with-stripe-secret-key
 STRIPE_PUBLISHABLE_KEY=replace-with-stripe-publishable-key
 STRIPE_WEBHOOK_SECRET=replace-with-stripe-webhook-secret
-REVENUECAT_WEBHOOK_SECRET=replace-with-revenuecat-webhook-auth-token
+APPLE_IAP_BUNDLE_ID=ai.hesychia.chat
+GOOGLE_PLAY_PACKAGE_NAME=ai.hesychia.chat
+GOOGLE_PLAY_SERVICE_ACCOUNT_JSON=replace-with-play-console-service-account-json
 # REVENUECAT_PRODUCT_PLAN_MAP={"hesychia_founders_monthly":"founders"}
 # Optional: pre-created Stripe Price ID. When empty, Checkout uses
 # SUBSCRIPTION_PRICE_* from settings.py ($10 USD / month by default).