Grant mobile plans from verified App Store and Play purchases (#78).

The app confirms a StoreKit signed transaction or Play purchase token. The backend checks it with Apple or Google before writing the ledger, and the RevenueCat webhook no longer grants access.

.env.example

@@ -83,8 +83,12 @@ STRIPE_WEBHOOK_SECRET=
 # Optional: pre-created Stripe Price ID for Founders. When empty, Checkout uses
 # SubscriptionPlan.price_cents / SUBSCRIPTION_PRICE_* ($10 USD / month Founders).
 STRIPE_PRICE_ID=
-# RevenueCat webhook Authorization bearer secret (store IAP).
-REVENUECAT_WEBHOOK_SECRET=
+# Native store purchases (#78). iOS verifies the StoreKit signed transaction
+# against Apple Root CA G3. Android calls the Play Developer API.
+APPLE_IAP_BUNDLE_ID=ai.hesychia.chat
+GOOGLE_PLAY_PACKAGE_NAME=ai.hesychia.chat
+# Service-account JSON (one line) or a path to the JSON file. Empty disables Play confirm.
+GOOGLE_PLAY_SERVICE_ACCOUNT_JSON=
 # Optional JSON map of store product id → plan slug, e.g.
 # REVENUECAT_PRODUCT_PLAN_MAP={"hesychia_founders_monthly":"founders"}
 # SUBSCRIPTION_PRICE_AMOUNT_CENTS=1000