cmux-billinglisted

# cmux Billing Read before changing billing, pricing, Stripe, Pro entitlement, checkout, webhook, or subscription code. ## Architecture map - `/api/billing/checkout` creates Stripe Checkout Sessions for Pro when `STRIPE_SECRET_KEY` is set. It sets `client_reference_id` to the Stack user id, auto-creates an anonymous Stack user for signed-out buyers, and falls back to the legacy Stack purchase path when Stripe is unset or `plan=team`. The "already active" short-circuit lives here. - `/api/billing/portal` resolves the current Stack user, looks up their `stripe_customers` row, and creates a Stripe customer portal session returning to `/pricing`. - `/api/billing/subscription` cancels or resumes the active Stripe Pro subscription; `/dashboard/billing` renders localized in-dashboard plan state and self-serve actions. - `web/services/billing/purchase.ts` is the shared idempotent recorder used by `/api/billing/complete` and `/api/stripe/webhook`. It attaches email to the purchaser, records `billing_email_claims` on conflict, and never cross-grants based on an unverified email. - VM code reads the plan from Stack `clientReadOnlyMetadata`: a non-empty `cmuxVmPlan` (operator override) takes precedence, otherwise `cmuxPlan` (the Stripe mirror) supplies the entitlement. `resolveProPlanStatus` reports Pro for an active `stripe_subscriptions` row or a paid `cmuxVmPlan` override (`pro`, `team`, `founders`); `billingManagement` stays Stripe-only, so a granted account shows Pro without a po