feat(billing): add RevenueCat Apple IAP entitlements

[FujiwaraChoki]

What changed

• Added a RevenueCat webhook route for Apple IAP subscription events, including event persistence/idempotency and entitlement updates.
• Added provider-aware billing behavior so Stripe-managed and App Store-managed subscriptions do not cross wires in checkout, portal, or webhook flows.
• Added subscription_provider and RevenueCat webhook event storage across Prisma, backend models, SQL migrations, and bootstrap schema.
• Updated settings UI for App Store-managed subscriptions and added Terms of Service for the iOS paywall link.
• Documented new RevenueCat env vars in .env.example and added production deploy notes.

Tests

• cd frontend && npm run test
• Result: 11 test files passed, 40 tests passed.

Deploy checklist

• Vercel project identified: fujiwarachokis-projects/supoclip with root directory frontend.
• Production env var REVENUECAT_WEBHOOK_AUTH_HEADER added from local frontend/.env without printing the value.
• Optional override vars were checked locally and were absent: REVENUECAT_APPLE_MONTHLY_PRODUCT_ID, REVENUECAT_APPLE_YEARLY_PRODUCT_ID.
• Run Prisma migration against the production frontend database after positively identifying production DATABASE_URL: cd frontend && DATABASE_URL="<production-database-url>" npx prisma migrate deploy.
• Apply backend SQL migration against the production backend database: psql "<production-backend-database-url>" -f backend/migrations/003_add_revenuecat_subscription_provider.sql.
• Deploy/redeploy production after database migrations complete.
• RevenueCat dashboard webhook URL is configured as https://www.supoclip.com/api/billing/revenuecat-webhook.

See DEPLOY_NOTES.md for the manual production steps that could not be safely completed from this checkout because no production DATABASE_URL was available.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
supoclip	Ready	Preview, Comment	Jul 2, 2026 4:05pm

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 80121b1cc8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".