Add account self-delete and subscription lifecycle sync (#34) (#39)

## Summary
- Closes [#34](#34)
- Companion for [chat_web_app#75](ai_ml_operations/chat_web_app#75) (portal cancel/change local sync)
- Soft-delete `DELETE /api/user/` for the authenticated user only: `deleted=True`, `is_active=False`, hide conversations, blacklist outstanding refresh tokens; staff self-delete rejected
- Stripe `customer.subscription.updated` / `deleted` webhooks sync plan status, `cancel_at_period_end`, and `current_period_end`; checkout assigns plan from `metadata.plan_slug`
- **UserAuthEvent audit**: `account_deleted`, `subscription_started` (first active plan), `subscription_updated` (plan/status/cancel changes) — visible on user admin
- Document FE contract in README (endpoint, response, post-delete logout)

## Test plan
- [ ] `uv run python manage.py test chat_backend.tests.test_views_users.CustomUserSelfDeleteTestCase finance.tests`
- [ ] Authenticated `DELETE /api/user/` soft-deletes self, hides conversations, blocks re-login, writes `account_deleted` auth event
- [ ] Checkout / Backer assign writes `subscription_started`; portal cancel/change writes `subscription_updated`
- [ ] Anonymous / staff self-delete rejected; body cannot target another user
- [ ] After portal cancel, webhook sets `cancel_at_period_end` / `canceled` on `GET /finance/subscription/`Reviewed-on: #39

llm_be/finance/tests/test_webhooks.py

@@ -8,10 +8,14 @@ from rest_framework import status
 from rest_framework.test import APITestCase
 
 from chat_backend.tests.factories import make_company, make_user
-from finance.models import Invoice, Payment
+from chat_backend.models import UserAuthEvent
+from finance.models import Invoice, Payment, UserSubscription
+from finance.services.plans import assign_plan_from_stripe, seed_subscription_plans
 from finance.services.webhooks import (
     dispatch_stripe_event,
     handle_checkout_session_completed,
+    handle_customer_subscription_deleted,
+    handle_customer_subscription_updated,
     handle_invoice_paid,
     handle_invoice_payment_failed,
 )
@@ -107,6 +111,81 @@ class WebhookHandlerUnitTestCase(APITestCase):
         )
         self.assertIsNone(result)
 
+    def test_checkout_assigns_plan_from_metadata(self):
+        seed_subscription_plans(update_existing=False)
+        session = {
+            "id": "cs_test_plan_meta",
+            "metadata": {"user_id": str(self.user.pk), "plan_slug": "founders"},
+            "customer": "cus_meta",
+            "subscription": "sub_meta",
+            "payment_intent": "pi_meta",
+            "payment_status": "paid",
+            "amount_total": 1000,
+            "currency": "usd",
+        }
+        handle_checkout_session_completed(session)
+        sub = UserSubscription.objects.get(user=self.user)
+        self.assertEqual(sub.plan.slug, "founders")
+        self.assertEqual(sub.source, UserSubscription.Source.STRIPE)
+        self.assertEqual(sub.status, UserSubscription.Status.ACTIVE)
+        started = UserAuthEvent.objects.get(
+            user=self.user,
+            event_type=UserAuthEvent.EventType.SUBSCRIPTION_STARTED,
+        )
+        self.assertIn("founders", started.detail)
+
+    def test_subscription_updated_sets_cancel_at_period_end(self):
+        seed_subscription_plans(update_existing=False)
+        assign_plan_from_stripe(
+            self.user,
+            plan_slug="founders",
+            stripe_subscription_id="sub_cancel",
+        )
+        result = handle_customer_subscription_updated(
+            {
+                "id": "sub_cancel",
+                "status": "active",
+                "cancel_at_period_end": True,
+                "current_period_end": 1_700_259_200,
+                "metadata": {"user_id": str(self.user.pk), "plan_slug": "founders"},
+            }
+        )
+        self.assertIsNotNone(result)
+        sub = UserSubscription.objects.get(user=self.user)
+        self.assertTrue(sub.cancel_at_period_end)
+        self.assertEqual(sub.status, UserSubscription.Status.ACTIVE)
+        self.assertIsNotNone(sub.current_period_end)
+        updated = UserAuthEvent.objects.filter(
+            user=self.user,
+            event_type=UserAuthEvent.EventType.SUBSCRIPTION_UPDATED,
+        ).latest("created")
+        self.assertIn("cancel_at_period_end=True", updated.detail)
+
+    def test_subscription_deleted_marks_canceled(self):
+        seed_subscription_plans(update_existing=False)
+        assign_plan_from_stripe(
+            self.user,
+            plan_slug="founders",
+            stripe_subscription_id="sub_gone",
+        )
+        result = handle_customer_subscription_deleted(
+            {
+                "id": "sub_gone",
+                "status": "canceled",
+                "current_period_end": 1_700_259_200,
+                "metadata": {"user_id": str(self.user.pk)},
+            }
+        )
+        self.assertIsNotNone(result)
+        sub = UserSubscription.objects.get(user=self.user)
+        self.assertEqual(sub.status, UserSubscription.Status.CANCELED)
+        self.assertFalse(sub.cancel_at_period_end)
+        updated = UserAuthEvent.objects.filter(
+            user=self.user,
+            event_type=UserAuthEvent.EventType.SUBSCRIPTION_UPDATED,
+        ).latest("created")
+        self.assertIn("status=canceled", updated.detail)
+
 
 class StripeWebhookViewTestCase(APITestCase):
     def setUp(self):