Emulo Pro: verify production billing lifecycle before public checkout

[ohad6k]

Goal

Activate Emulo Pro production billing only after every server-side proof passes. This issue tracks provider state; it must never contain tokens, signing secrets, cookies, customer identifiers, or webhook payloads.

Already proven

• Public Free / $9 monthly / $79 annual pricing is live
• Production Worker and isolated D1 are deployed
• GitHub OAuth start redirects to GitHub with checkout disabled
• Production Polar monthly and annual products exist privately
• Checkout, portal, and unsigned/unconfigured webhook routes fail closed
• D1 refusal checks produce zero billing writes
• Open-source local Emulo remains independent of cloud entitlement

Provider gates

• Polar payout/organization state is accepted
• Create production OAT with only checkouts:write and customer_sessions:write
• Store OAT directly as Cloudflare POLAR_ACCESS_TOKEN
• Create Raw Polar webhook for the seven documented subscription lifecycle events
• Store its signing secret directly as Cloudflare POLAR_WEBHOOK_SECRET
• Prove one signed test delivery without granting an unknown account
• Prove production GitHub sign-in with count-only D1 evidence

Explicitly approved real-money gate

• Owner explicitly approves the bounded charge before enabling checkout
• Purchase activates only after a signed webhook
• Hosted portal opens for the authenticated account
• Cancellation/refund state converges without manual D1 edits
• Checkout is disabled again after the test
• Owner separately approves public enablement

Implementation and receipts are in PR #21 and docs/release/emulo-polar-production-activation.md.