billing: add tenant billing contact fields and per-tenant controller

[jshearer]

Summary

Customers cannot self-serve billing email changes today. Every request requires manual Stripe intervention. This adds admin-editable billing contact fields on tenants, a GraphQL mutation for managing them, and a per-tenant controller that reconciles the Stripe-backed subset to Stripe asynchronously.

• Adds billing_email, billing_name, and billing_address fields to tenants, letting admins self-serve billing contact changes through a new setBillingContact GraphQL mutation instead of requesting manual Stripe edits
• Introduces a per-tenant TenantController automation that reconciles DB-authoritative billing contact data to Stripe asynchronously
• Updates existing customer-creation paths (createBillingSetupIntent, billing-integrations) to prefer tenant-managed billing email over JWT claims when creating new Stripe customers

How it works

The setBillingContact mutation writes to the DB. A trigger then wakes the tenant's controller task, which reads current DB state, compares against the Stripe customer, and calls update_customer_billing_profile to sync the changes to the Stripe customer record if they differ.

Migration

20260429120000_tenant_controller_billing_contact.sql:

• Adds columns. New tenants get a controller task via an insert trigger. Existing tenants get one lazily: wake_tenant_controller creates the task on-demand if controller_task_id is null, so setBillingContact or customer-creation paths work without a pre-existing task row.
• Any source of change to these billing fields will trigger the automation to sync to stripe
• Backfills billing_email and billing_address from CDC-synced stripe.customers so existing data matches Stripe without triggering reconciliation. Only tenants that received billing data from this backfill get a controller task row; the rest get one on first use.

Testing

I tested this e2e in a local stack with a testmode Stripe API key