Grant mobile plans from verified App Store and Play purchases (#78).

The app confirms a StoreKit signed transaction or Play purchase token. The backend checks it with Apple or Google before writing the ledger, and the RevenueCat webhook no longer grants access.

.env.prod.example

@@ -91,7 +91,9 @@ OAUTH_CALLBACK_BASE_URL=https://chatbackend.aimloperations.com
 STRIPE_SECRET_KEY=replace-with-stripe-secret-key
 STRIPE_PUBLISHABLE_KEY=replace-with-stripe-publishable-key
 STRIPE_WEBHOOK_SECRET=replace-with-stripe-webhook-secret
-REVENUECAT_WEBHOOK_SECRET=replace-with-revenuecat-webhook-auth-token
+APPLE_IAP_BUNDLE_ID=ai.hesychia.chat
+GOOGLE_PLAY_PACKAGE_NAME=ai.hesychia.chat
+GOOGLE_PLAY_SERVICE_ACCOUNT_JSON=replace-with-play-console-service-account-json
 # REVENUECAT_PRODUCT_PLAN_MAP={"hesychia_founders_monthly":"founders"}
 # Optional: pre-created Stripe Price ID. When empty, Checkout uses
 # SUBSCRIPTION_PRICE_* from settings.py ($10 USD / month by default).