Stripe billing + bundle subscription lifecycle

Policy bundles can now be locked behind a Stripe subscription. Lifecycle states: PENDING_PAYMENT → PAID → ACTIVE → GRACE → LAPSED. The bundle stays enforced during grace windows. Stripe webhook idempotency uses compare-and-swap on the handledAt column. The billing/reconciliation endpoint shows drift between internal meters and the Stripe export checkpoint.