Grant mobile plans from verified App Store and Play purchases (#78) (#79)

## Summary
- Mobile access is granted by `POST /api/finance/store/confirm/` after the app finishes a StoreKit or Play Billing purchase.
- App Store signed transactions are checked against Apple Root CA G3. Play purchase tokens are checked with the Play Developer API.
- The RevenueCat webhook no longer grants a plan. Stripe Checkout and the Stripe webhook stay for the website.
- A purchase account token must match the signed-in user, and a transaction already linked to another account is rejected. Access ends when the verified period end passes unless the app confirms again.

Client: ai_ml_operations/chat_web_app#122

## Config
- `APPLE_IAP_BUNDLE_ID` (default `ai.hesychia.chat`)
- `GOOGLE_PLAY_PACKAGE_NAME`
- `GOOGLE_PLAY_SERVICE_ACCOUNT_JSON` (JSON or a file path)
- Plan `revenuecat_product_id` or `REVENUECAT_PRODUCT_PLAN_MAP` maps the store product to a plan

## Test plan
- [x] `python manage.py test monetization.tests.test_store_purchases monetization.tests.test_revenuecat monetization.tests.test_plans_quotas`
- [ ] Confirm an App Store sandbox transaction and a Play license-test purchase against a configured backend
- [ ] Confirm a token already linked to another user is rejected
- [ ] Confirm `GET /subscription/` returns `store_account_token` and flips a lapsed store sub to canceled

Reviewed-on: #79

llm_be/monetization/urls.py

@@ -1,12 +1,12 @@
 from django.urls import path
 
 from monetization.views import (
+    ConfirmStorePurchaseView,
     CreateBillingPortalSessionView,
     CreateCheckoutSessionView,
     InvoiceListView,
     PaymentListView,
     PlanListView,
-    RevenueCatWebhookView,
     StripeWebhookView,
     SubscriptionMeView,
 )
@@ -42,14 +42,14 @@ urlpatterns = [
         SubscriptionMeView.as_view(),
         name="finance_subscription_me",
     ),
+    path(
+        "store/confirm/",
+        ConfirmStorePurchaseView.as_view(),
+        name="finance_store_confirm",
+    ),
     path(
         "webhooks/stripe/",
         StripeWebhookView.as_view(),
         name="finance_stripe_webhook",
     ),
-    path(
-        "webhooks/revenuecat/",
-        RevenueCatWebhookView.as_view(),
-        name="finance_revenuecat_webhook",
-    ),
 ]