feat: sync rcat data (#13628)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* RevenueCat support: public webhook endpoint, webhook handler/service,
nightly reconciliation and per-user sync; subscriptions now expose
provider and iapStore; new user-facing error for App Store/Play-managed
subscriptions.
* **Chores**
* Multi-provider subscription schema (Provider, IapStore); Stripe
credentials moved into payment.stripe (top-level apiKey/webhookKey
deprecated); new payment.revenuecat config and defaults added.
* **Tests**
  * Comprehensive RevenueCat integration test suite and snapshots.
* **Documentation**
  * Admin config descriptions updated with deprecation guidance.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

packages/backend/server/src/plugins/payment/service.ts

@@ -13,6 +13,7 @@ import {
   InvalidLicenseSessionId,
   InvalidSubscriptionParameters,
   LicenseRevealed,
+  ManagedByAppStoreOrPlay,
   OnEvent,
   SameSubscriptionRecurring,
   SubscriptionExpired,
@@ -165,6 +166,11 @@ export class SubscriptionService {
       throw new SubscriptionNotExists({ plan: identity.plan });
     }
 
+    // IAP read-only: RevenueCat-managed subscriptions cannot be modified on web
+    if (subscription.provider === 'revenuecat') {
+      throw new ManagedByAppStoreOrPlay();
+    }
+
     if (!subscription.stripeSubscriptionId) {
       throw new CantUpdateOnetimePaymentSubscription(
         'Onetime payment subscription cannot be canceled.'
@@ -211,6 +217,11 @@ export class SubscriptionService {
       throw new SubscriptionNotExists({ plan: identity.plan });
     }
 
+    // IAP read-only: RevenueCat-managed subscriptions cannot be modified on web
+    if (subscription.provider === 'revenuecat') {
+      throw new ManagedByAppStoreOrPlay();
+    }
+
     if (!subscription.canceledAt) {
       throw new SubscriptionHasNotBeenCanceled();
     }
@@ -258,6 +269,11 @@ export class SubscriptionService {
       throw new SubscriptionNotExists({ plan: identity.plan });
     }
 
+    // IAP read-only: RevenueCat-managed subscriptions cannot be modified on web
+    if (subscription.provider === 'revenuecat') {
+      throw new ManagedByAppStoreOrPlay();
+    }
+
     if (!subscription.stripeSubscriptionId) {
       throw new CantUpdateOnetimePaymentSubscription();
     }
@@ -312,6 +328,10 @@ export class SubscriptionService {
       throw new SubscriptionNotExists({ plan: identity.plan });
     }
 
+    if (subscription.provider === 'revenuecat') {
+      throw new ManagedByAppStoreOrPlay();
+    }
+
     if (!subscription.stripeSubscriptionId) {
       throw new CantUpdateOnetimePaymentSubscription();
     }