Grant mobile plans from verified App Store and Play purchases (#78) (#79)

## Summary
- Mobile access is granted by `POST /api/finance/store/confirm/` after the app finishes a StoreKit or Play Billing purchase.
- App Store signed transactions are checked against Apple Root CA G3. Play purchase tokens are checked with the Play Developer API.
- The RevenueCat webhook no longer grants a plan. Stripe Checkout and the Stripe webhook stay for the website.
- A purchase account token must match the signed-in user, and a transaction already linked to another account is rejected. Access ends when the verified period end passes unless the app confirms again.

Client: ai_ml_operations/chat_web_app#122

## Config
- `APPLE_IAP_BUNDLE_ID` (default `ai.hesychia.chat`)
- `GOOGLE_PLAY_PACKAGE_NAME`
- `GOOGLE_PLAY_SERVICE_ACCOUNT_JSON` (JSON or a file path)
- Plan `revenuecat_product_id` or `REVENUECAT_PRODUCT_PLAN_MAP` maps the store product to a plan

## Test plan
- [x] `python manage.py test monetization.tests.test_store_purchases monetization.tests.test_revenuecat monetization.tests.test_plans_quotas`
- [ ] Confirm an App Store sandbox transaction and a Play license-test purchase against a configured backend
- [ ] Confirm a token already linked to another user is rejected
- [ ] Confirm `GET /subscription/` returns `store_account_token` and flips a lapsed store sub to canceled

Reviewed-on: #79

llm_be/monetization/migrations/0006_store_purchase_sources.py

@@ -0,0 +1,56 @@
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("finance", "0005_revenuecat_fields"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="invoice",
+            name="provider",
+            field=models.CharField(
+                choices=[
+                    ("stripe", "Stripe"),
+                    ("revenuecat", "RevenueCat"),
+                    ("app_store", "App Store"),
+                    ("play_store", "Play Store"),
+                ],
+                default="stripe",
+                max_length=32,
+            ),
+        ),
+        migrations.AlterField(
+            model_name="payment",
+            name="provider",
+            field=models.CharField(
+                choices=[
+                    ("stripe", "Stripe"),
+                    ("revenuecat", "RevenueCat"),
+                    ("app_store", "App Store"),
+                    ("play_store", "Play Store"),
+                ],
+                default="stripe",
+                max_length=32,
+            ),
+        ),
+        migrations.AlterField(
+            model_name="usersubscription",
+            name="source",
+            field=models.CharField(
+                choices=[
+                    ("none", "None"),
+                    ("stripe", "Stripe"),
+                    ("revenuecat", "RevenueCat"),
+                    ("app_store", "App Store"),
+                    ("play_store", "Play Store"),
+                    ("backer", "Backer"),
+                    ("admin", "Admin"),
+                ],
+                default="none",
+                max_length=32,
+            ),
+        ),
+    ]