Phase 3 backend: tier-gate enforcement + billing webhook

- Tier capability model (pro-layers, geo-analytics, custom-domain, retention)
- Pro-only layer types (video/particle/animatedGradient) rejected on card
  create/replace/patch for Free; geo analytics gated to Pro+ (402 tier_limit)
- Gates read the authoritative DB tier, so upgrades apply without re-login
- POST /v1/webhooks/revenuecat: shared-secret auth (constant-time), maps
  RevenueCat events to users.tier (purchase→pro/team/enterprise, cancel→free),
  unknown user = 2xx no-op; users::update_tier query

93 backend tests; fmt + clippy clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

cardclaws-backend/crates/cardclaws-api/tests/analytics_test.rs

@@ -106,7 +106,8 @@ async fn ingest_rejects_server_only_event_type() {
 #[tokio::test]
 async fn geo_breakdown_groups_by_country() {
     let app = require_app!();
-    let token = app.register_and_token().await;
+    let (token, user_id) = app.register_and_user().await;
+    app.set_tier(&user_id, "pro").await; // geo analytics are Pro-gated
     let (id, _) = create_and_publish(&app, &token).await;
 
     // Two client events with a forwarded IP → FakeGeo resolves both to US.