Grant mobile plans from verified App Store and Play purchases (#78) (#79)

## Summary
- Mobile access is granted by `POST /api/finance/store/confirm/` after the app finishes a StoreKit or Play Billing purchase.
- App Store signed transactions are checked against Apple Root CA G3. Play purchase tokens are checked with the Play Developer API.
- The RevenueCat webhook no longer grants a plan. Stripe Checkout and the Stripe webhook stay for the website.
- A purchase account token must match the signed-in user, and a transaction already linked to another account is rejected. Access ends when the verified period end passes unless the app confirms again.

Client: ai_ml_operations/chat_web_app#122

## Config
- `APPLE_IAP_BUNDLE_ID` (default `ai.hesychia.chat`)
- `GOOGLE_PLAY_PACKAGE_NAME`
- `GOOGLE_PLAY_SERVICE_ACCOUNT_JSON` (JSON or a file path)
- Plan `revenuecat_product_id` or `REVENUECAT_PRODUCT_PLAN_MAP` maps the store product to a plan

## Test plan
- [x] `python manage.py test monetization.tests.test_store_purchases monetization.tests.test_revenuecat monetization.tests.test_plans_quotas`
- [ ] Confirm an App Store sandbox transaction and a Play license-test purchase against a configured backend
- [ ] Confirm a token already linked to another user is rejected
- [ ] Confirm `GET /subscription/` returns `store_account_token` and flips a lapsed store sub to canceled

Reviewed-on: #79

llm_be/monetization/tests/test_revenuecat.py

@@ -2,10 +2,7 @@
 
 from __future__ import annotations
 
-from django.test import TestCase, override_settings
-from django.urls import reverse
-from rest_framework import status
-from rest_framework.test import APIClient
+from django.test import TestCase
 
 from chat_backend.tests.factories import make_user
 from monetization.models import Invoice, Payment, SubscriptionPlan, UserSubscription
@@ -129,50 +126,3 @@ class RevenueCatDispatchTests(TestCase):
         self.assertEqual(sub.status, UserSubscription.Status.CANCELED)
 
 
-@override_settings(REVENUECAT_WEBHOOK_SECRET="test-rc-secret")
-class RevenueCatWebhookViewTests(TestCase):
-    def setUp(self):
-        seed_subscription_plans(update_existing=False)
-        self.client = APIClient()
-        self.url = reverse("finance_revenuecat_webhook")
-        self.user = make_user(email="rcview@example.com")
-        founders = SubscriptionPlan.objects.get(slug="founders")
-        founders.revenuecat_product_id = "hesychia_founders_monthly"
-        founders.save(update_fields=["revenuecat_product_id", "last_modified"])
-
-    def test_missing_secret_config(self):
-        with override_settings(REVENUECAT_WEBHOOK_SECRET=""):
-            response = self.client.post(
-                self.url, {"event": _rc_event()}, format="json"
-            )
-        self.assertEqual(response.status_code, status.HTTP_503_SERVICE_UNAVAILABLE)
-
-    def test_unauthorized(self):
-        response = self.client.post(
-            self.url,
-            {"event": _rc_event(app_user_id=str(self.user.pk))},
-            format="json",
-            HTTP_AUTHORIZATION="Bearer wrong",
-        )
-        self.assertEqual(response.status_code, status.HTTP_401_UNAUTHORIZED)
-
-    def test_success(self):
-        response = self.client.post(
-            self.url,
-            {"api_version": "1.0", "event": _rc_event(app_user_id=str(self.user.pk))},
-            format="json",
-            HTTP_AUTHORIZATION="Bearer test-rc-secret",
-        )
-        self.assertEqual(response.status_code, status.HTTP_200_OK)
-        self.assertTrue(
-            UserSubscription.objects.filter(
-                user=self.user,
-                source=UserSubscription.Source.REVENUECAT,
-                status=UserSubscription.Status.ACTIVE,
-            ).exists()
-        )
-        self.assertTrue(
-            Invoice.objects.filter(
-                user=self.user, provider=Invoice.Provider.REVENUECAT
-            ).exists()
-        )