Grant mobile plans from verified App Store and Play purchases (#78) (#79)

## Summary
- Mobile access is granted by `POST /api/finance/store/confirm/` after the app finishes a StoreKit or Play Billing purchase.
- App Store signed transactions are checked against Apple Root CA G3. Play purchase tokens are checked with the Play Developer API.
- The RevenueCat webhook no longer grants a plan. Stripe Checkout and the Stripe webhook stay for the website.
- A purchase account token must match the signed-in user, and a transaction already linked to another account is rejected. Access ends when the verified period end passes unless the app confirms again.

Client: ai_ml_operations/chat_web_app#122

## Config
- `APPLE_IAP_BUNDLE_ID` (default `ai.hesychia.chat`)
- `GOOGLE_PLAY_PACKAGE_NAME`
- `GOOGLE_PLAY_SERVICE_ACCOUNT_JSON` (JSON or a file path)
- Plan `revenuecat_product_id` or `REVENUECAT_PRODUCT_PLAN_MAP` maps the store product to a plan

## Test plan
- [x] `python manage.py test monetization.tests.test_store_purchases monetization.tests.test_revenuecat monetization.tests.test_plans_quotas`
- [ ] Confirm an App Store sandbox transaction and a Play license-test purchase against a configured backend
- [ ] Confirm a token already linked to another user is rejected
- [ ] Confirm `GET /subscription/` returns `store_account_token` and flips a lapsed store sub to canceled

Reviewed-on: #79

llm_be/monetization/serializers.py

@@ -59,8 +59,23 @@ class PortalSessionSerializer(serializers.Serializer):
     return_url = serializers.URLField(required=False, allow_blank=False)
 
 
+class StorePurchaseConfirmSerializer(serializers.Serializer):
+    store = serializers.ChoiceField(choices=("app_store", "play_store"))
+    product_id = serializers.CharField(max_length=255)
+    transaction_id = serializers.CharField(
+        max_length=255, required=False, allow_blank=True
+    )
+    purchase_token = serializers.CharField(
+        max_length=4096, required=False, allow_blank=True
+    )
+    signed_transaction = serializers.CharField(required=False, allow_blank=True)
+
+
 class SubscriptionPlanSerializer(serializers.ModelSerializer):
     features = serializers.SerializerMethodField()
+    store_product_id = serializers.CharField(
+        source="revenuecat_product_id", read_only=True
+    )
 
     class Meta:
         model = SubscriptionPlan
@@ -78,6 +93,7 @@ class SubscriptionPlanSerializer(serializers.ModelSerializer):
             "prompt_window_hours",
             "monthly_token_quota",
             "sort_order",
+            "store_product_id",
         ]
         read_only_fields = fields