feat(billing): Stripe + abbonamento Pro con trial 30gg (ADR 0004)

Chiude la decisione "payment provider" aperta in CLAUDE.md.

**Modello**: free 30gg post-signup (no carta richiesta) → Pro mensile €9,90 / annuale €89. Allinea il paywall al confine fra fase INTENSIVE e TRANSITION (PRD §5.1), quando l'utente ha già visto i primi risultati. Dopo la scadenza l'app non si "spegne": storico restano consultabili (sola lettura), ma generazione piani / nuove pesate / digiuni / foto / export richiedono abbonamento attivo.

**Schema**: nuova tabella `subscriptions` (1:1 con users) con stati TRIALING/ACTIVE/PAST_DUE/CANCEL_AT_PERIOD_END/CANCELED/EXPIRED + `billing_webhook_events` per idempotenza dei retry Stripe.

**Backend** (`apps/api/src/modules/billing/`):
- `GET /me/billing/status` — snapshot + derived (kind, isPro, trialDaysRemaining)
- `POST /me/billing/checkout` — crea Stripe Checkout Session (subscription mode + Stripe Tax + tax_id_collection)
- `POST /me/billing/portal` — Customer Portal Session
- `POST /webhooks/stripe` — raw body, firma HMAC, idempotenza per `event.id`, dispatch su `customer.subscription.*`, `checkout.session.completed`, `invoice.payment_failed`
- Plugin `requirePro()` (402 payment_required) applicato a 9 rotte: meal-plans CRUD, weight-entries POST, check-ins POST, fast-events POST/PATCH, fasting/pause POST, export.pdf (plan+tracking)

**Shared** (`@ketopath/shared/billing/pro-status`):
- `isProActive(snap)` — verifica live (gestisce anche TRIALING con `trialEndsAt` passato in caso di cron in ritardo)
- `deriveProStatus(snap)` — kind + isPro + trialDaysRemaining + accessEndsAt per l'UI
- `computeTrialEndsAt(signupAt, days=30)`
- 11 unit test

**Frontend** (`apps/web/src/app/[locale]/billing/`):
- Pagina `/billing` editoriale (capitolo VIII) con StatusBlock per ogni kind, BillingActionsBar client (transitions, redirect a Stripe), 3 benefits
- `<TrialBanner>` in SignedInDashboard (3 stati: trial in corso oro / scaduto pomodoro / past_due pomodoro)
- Nav item "Abbonamento" (chapter VI) nel grid asimmetrico
- i18n IT completo (`Billing` namespace)

**Soft-degradation**: env Stripe (`STRIPE_SECRET_KEY`, `STRIPE_WEBHOOK_SECRET`, `STRIPE_PRICE_ID_*`, `BILLING_RETURN_URL`) sono tutte opzionali. Senza configurazione i route billing rispondono 503 e il banner trial mostra "pagamenti non ancora attivati" — utenti in trial continuano a usare l'app.

99/99 test verdi, lint pulito su tutto il monorepo.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/api/src/modules/tracking/check-in.routes.ts

@@ -5,6 +5,7 @@ import { dailyCheckInInputSchema } from '@ketopath/shared';
 import type { FastifyPluginAsync } from 'fastify';
 
 import { requireAuth } from '../../plugins/auth.js';
+import { requirePro } from '../../plugins/require-pro.js';
 
 function todayDateOnly(): Date {
   const d = new Date();
@@ -54,36 +55,40 @@ export const checkInRoutes: FastifyPluginAsync = async (fastify) => {
     };
   });
 
-  fastify.post('/me/check-ins', { preHandler: requireAuth() }, async (request, reply) => {
-    const parsed = dailyCheckInInputSchema.safeParse(request.body);
-    if (!parsed.success) {
-      return reply.code(400).send({ error: 'invalid_body', issues: parsed.error.issues });
-    }
-    const data = parsed.data;
-    const userId = request.user!.id;
-    const date = new Date(data.date);
-    date.setHours(0, 0, 0, 0);
+  fastify.post(
+    '/me/check-ins',
+    { preHandler: [requireAuth(), requirePro()] },
+    async (request, reply) => {
+      const parsed = dailyCheckInInputSchema.safeParse(request.body);
+      if (!parsed.success) {
+        return reply.code(400).send({ error: 'invalid_body', issues: parsed.error.issues });
+      }
+      const data = parsed.data;
+      const userId = request.user!.id;
+      const date = new Date(data.date);
+      date.setHours(0, 0, 0, 0);
 
-    const item = await fastify.prisma.dailyCheckIn.upsert({
-      where: { userId_date: { userId, date } },
-      create: {
-        userId,
-        date,
-        energy: data.energy ?? null,
-        sleep: data.sleep ?? null,
-        hunger: data.hunger ?? null,
-        mood: data.mood ?? null,
-        notes: data.notes ?? null,
-      },
-      update: {
-        energy: data.energy ?? null,
-        sleep: data.sleep ?? null,
-        hunger: data.hunger ?? null,
-        mood: data.mood ?? null,
-        notes: data.notes ?? null,
-      },
-    });
+      const item = await fastify.prisma.dailyCheckIn.upsert({
+        where: { userId_date: { userId, date } },
+        create: {
+          userId,
+          date,
+          energy: data.energy ?? null,
+          sleep: data.sleep ?? null,
+          hunger: data.hunger ?? null,
+          mood: data.mood ?? null,
+          notes: data.notes ?? null,
+        },
+        update: {
+          energy: data.energy ?? null,
+          sleep: data.sleep ?? null,
+          hunger: data.hunger ?? null,
+          mood: data.mood ?? null,
+          notes: data.notes ?? null,
+        },
+      });
 
-    return reply.code(201).send({ item: { id: item.id } });
-  });
+      return reply.code(201).send({ item: { id: item.id } });
+    },
+  );
 };