fix(credits): atomic Stripe webhook fulfillment + idempotency + privilege guard

[kimhons]

Summary

Resolves 5 CRITICAL/HIGH findings from the 2026-05-01 team-review of the credit fulfillment path.

What changed

• New add_credits RPC (supabase/migrations/20260501000000_credit_purchase_idempotency.sql): single Postgres transaction over the credit_purchases insert, user_credits UPDATE, and credit_transactions log. Idempotency check inside the function via stripe_payment_intent_id — duplicate Stripe webhook deliveries return already_fulfilled=true with no double-grant and no stranded sentinel row.
• Privilege escalation closed: REVOKE EXECUTE ... FROM PUBLIC; GRANT EXECUTE ... TO service_role on both add_credits and deduct_credits. Previously, any authenticated PostgREST caller could credit/debit any user.
• UNIQUE NOT NULL on credit_purchases.stripe_payment_intent_id: hard backstop for the idempotency check; backfill DELETE for any pre-existing NULLs.
• credit_transactions INSERT policy scoped TO service_role (was open to all authenticated clients via WITH CHECK (true)).
• stripe-service.ts: handlePaymentIntentSucceeded now logs then rethrows so Stripe retries on transient failures (was silently swallowing → permanent credit loss). fulfillCreditPurchase collapses to a single RPC call.
• credit-service.ts: addCredits rewritten to call the atomic RPC; returns {newBalance, alreadyFulfilled}. New optional fulfillment param wires the Stripe metadata into the same transaction.
• api/credits/purchase/route.ts: switched from PaymentIntent to Checkout Session (mode='payment') and returns checkoutUrl.
• CreditPurchaseModal.tsx: removed dead data.newBalance / onPurchaseComplete logic; now redirects to Stripe-hosted Checkout. The previous PaymentIntent flow was never wired (modal read fields the route never returned).

Issues closed (all from team-review #d64e8d5 ancestor)

Severity	Finding	Status
CRITICAL	Stripe webhook double-credit on retry	FIXED
CRITICAL	Webhook insert wrong column names (amount_cents → amount_paid_cents, dropped phantom status)	FIXED
CRITICAL	addCredits non-atomic read-modify-write	FIXED
HIGH	CreditPurchaseModal reads fields route never returns → unwired	FIXED
HIGH	credit_transactions INSERT RLS missing role scope	FIXED
HIGH (re-review)	Webhook errors swallowed → no Stripe retry	FIXED
HIGH (re-review)	Insert-then-RPC split transaction → stranded row	FIXED
HIGH (re-review)	Supabase error code field uncertainty	OBVIATED (single-RPC path)
MEDIUM (re-review)	UNIQUE on nullable column allows multiple NULLs	FIXED
MEDIUM (re-review)	SECURITY DEFINER functions callable by authenticated	FIXED

Test plan

• tsc --noEmit exit 0
• next build exit 0 (539 kB first load)
• Jest: 14,568 / 14,587 passing (19 environment-skipped, 0 failed). Added 7 new tests covering: atomic RPC happy path, fulfillment payload forwarding, alreadyFulfilled=true short-circuit, non-array RPC response, non-positive amount guard, RPC error propagation, empty-result guard.
• Dev server proof-of-life: HTTP 200 on /.
• Re-review by code-reviewer + security-reviewer: PASS on all originally-flagged items.

Out-of-scope follow-ups (do NOT block merge)

1. HIGH — stripe-service.ts:644 handleInvoicePaid swallows errors on the subscription-renewal credit-reset path. Same pattern as the bug fixed here for credit purchases. Pre-existing; not in original team-review scope.
2. MEDIUM — stripe-service.ts:685 handleInvoicePaymentFailed missing log on catch.
3. LOW — add_credits idempotency SELECT runs before FOR UPDATE lock. UNIQUE constraint is the hard backstop; a true concurrent race surfaces as one extra Stripe retry rather than silent skip. Could tighten with INSERT ... ON CONFLICT DO NOTHING RETURNING id.
4. LOW — resetMonthlyAllowance writes to credit_transactions via the admin client, relying on caller-side privilege rather than schema. Architectural note.

Breaking changes

• creditService.addCredits return type changed from Promise<number> to Promise<{ newBalance: number; alreadyFulfilled: boolean }>. Sole caller (stripe-service.ts) updated in this PR.
• CreditPurchaseModal onPurchaseComplete prop removed (unused; the modal now always redirects to Stripe-hosted Checkout).