test(billing): W3 billing-block integration suite — purchasable-set, no self-serve cancel/downgrade, webhook tier transitions

[mastermanas805]

What

Closes the biggest gap in docs/sessions/2026-06-04/USER-FLOW-INVENTORY-AND-TEST-MATRIX.md §E: the revenue-critical billing block had near-zero real-backend integration coverage. Adds a DB-backed (TEST_DATABASE_URL) integration suite in the handlers package.

All NEW files — no edits to billing.go or any existing billing_*_test.go, so no conflict with the in-flight #246 (W0). Reuses existing helpers (seedVerifiedTeamUser, cov2CheckoutApp, changePlanAppReal/changePlanReq, postCheckoutReq, cov2WebhookAppReal, signRazorpayPayload, makeSubscriptionChargedPayloadWithPlan, makeSubscriptionCancelledPayload); none redefined.

Coverage

• Team is NOT buyable (§E3) — registry-iterating assertion TestBillingBlock_SelfServePurchasableSet_IsExactlyHobbyHobbyPlusPro drives every plans.Registry tier through the real CreateCheckoutAPI and asserts the set reaching the Razorpay CreateSubscription seam is exactly {hobby, hobby_plus, pro}. Reds if Team is re-enabled or a new tier silently becomes chargeable (rule 18). Team → 400 tier_not_yet_available; growth → invalid_plan. Mirrored for the change-plan surface.
• No self-serve cancel/downgrade (§E10) — router.go source-scan negative assertion (no non-admin cancel/downgrade route) + ChangePlanAPI rejects every lower/equal target with downgrade_not_self_serve + a support agent_action, asserting team tier is left unchanged. same_plan edge covered.
• Webhook tier transitions (§E4/E5/E6/E7) — subscription.charged upgrade elevates plan_tier AND promotes all active resources (rule 5); subscription.cancelled downgrade drops plan_tier to the courtesy floor but leaves resource tiers (user-benefit asymmetry); bad signature → 400 invalid_signature (tier unchanged); unknown team → 404 team_not_found (rows-affected-0 / ErrTeamNotFound).
• Checkout graceful failure — unconfigured plan_id → 503 billing_not_configured; live-key-in-nonprod → 503 billing_misconfigured (CreateSubscription never called).

Gate

internal/handlers green for all new tests. The registry-iterating assertion was verified failing-then-passing (reds when team is added to the expected purchasable set). The 20 unrelated handlers/models failures in full ./... are pre-existing local-env flakes (NATS/customer-DB/GitHub creds unreachable on a bare laptop) — verified to reproduce identically on clean origin/master with these files stashed (diff of introduced failures is empty). CI is authoritative.

🤖 Generated with Claude Code