fix(payments): bound on_hold subscription coverage to the paid-through period (GHSA-hw94-8c4h-m9qp) - #5601

Summary

Fixes GHSA-hw94-8c4h-m9qp ("On-hold subscriptions can retain paid entitlement beyond the paid-through period").

isCoveringAt treated on_hold as covering unconditionally, unlike cancelled (bounded by currentPeriodEnd > at). Dodo keeps a payment-failed subscription in on_hold indefinitely — no further webhook is guaranteed — so a dead hold kept counting as the "best covering sub" forever. Concrete consequences on main today:

• Entitlement recompute clobber: any recompute re-elected the stale hold; a higher-tier dead hold (e.g. enterprise) outranked a later paid subscription and overwrote the entitlement with an already-expired one — denying a paying customer.
• Business seats: grants tied to an expired api_business hold were never revoked (revokeBusinessProGrantsIfNotCovering / reconcileBusinessProGrants both saw "still covering"), keeping seat state alive and the owner's 4-seat cap consumed indefinitely.
• Activation/welcome flows counted an expired hold as current access.
• Checkout lockout: getCheckoutBlockingSubscription blocked new checkout in the billing family while any on_hold row existed — a user whose payment failed once could never self-serve re-subscribe.
• No terminal state: handleSubscriptionOnHold never recomputed entitlements, so nothing ever clamped the entitlement if Dodo went silent after the hold.

Fix

1. isCoveringAt (convex/payments/subscriptionHelpers.ts): on_hold now carries the same currentPeriodEnd bound as cancelled. active stays unbounded on purpose — a late renewal webhook must not cut off a paying customer; staleness there is owned by the renewal-verification/reconciliation machinery. All consumers inherit the bound.
2. handleSubscriptionOnHold: recomputes entitlements after the status patch. Policy is unchanged for the normal case — a paid-through hold keeps access exactly until currentPeriodEnd — but a hold event past the boundary now downgrades immediately unless another sub covers, and the dunning episode anchor (onHoldAt, feat(billing): dunning + winback email lifecycle — on_hold day-0/3/7 recovery, 30-day winback, suppression-aware #4932) is untouched.
3. getCheckoutBlockingSubscription (convex/payments/billing.ts): on_hold blocks checkout only while paid-through (same bound cancelled already had), ending the permanent re-subscribe lockout. Within-period holds still block — recovery belongs in the customer portal, not a duplicate checkout.
4. Anonymous-claim merge (billing.ts): replaced an inline (previously unbounded) copy of the coverage predicate with isCoveringAt.

Type of change

• Bug fix

Affected areas

• API endpoints (/api/*)
• Other: Convex payments/entitlement lifecycle (webhooks, checkout guard, business seats)

Checklist

• Tested on worldmonitor.app variant
• Tested on tech.worldmonitor.app variant (if applicable)
• New RSS feed domains added to api/rss-proxy.js allowlist (if adding feeds)
• No API keys or secrets committed
• TypeScript compiles without errors (npm run typecheck)

Documentation Alignment Checklist

N/A — no documentation claims, generated docs, or Redis key contracts change in this PR.

Verification

• New convex/__tests__/onhold-entitlement-bound.test.ts (9 tests): unit bounds for all four statuses; paid-through hold preserved and clamped to currentPeriodEnd; post-boundary hold event downgrades to free with the dunning anchor unmoved; stale higher-tier hold no longer clobbers a later paid subscription; stale hold no longer blocks checkout while a live hold still does.
• RED-before verified: 4 of the 9 tests fail against the pre-fix code (the on_hold bound, post-boundary downgrade, clobber regression, checkout unlock); the other 5 pass on both sides — they pin the behavior that must not change (active/cancelled/expired semantics, paid-through hold preservation, within-period checkout block).
• Full convex suite: 56 files / 1010 tests green (includes the pre-existing subscription.on_hold webhook, dunning-email, business-seats, and checkout-block tests, all unchanged).
• npm run typecheck, npm run typecheck:api + audit-convex-string-calls clean.

Notes / consciously out of scope

• isLapsedAt still excludes on_hold from win-back cohorts; a past-boundary hold user is now neither "current" nor "lapsed" for email classification. If they should join win-back, that's a small follow-up.
• Entitlement read paths (validUntil checks in gateway/MCP/API-key/Convex queries) already denied expired rows; this PR fixes the coverage-derivation layer that kept re-asserting stale coverage into those rows and into the non-validUntil surfaces listed above.

Screenshots

N/A — backend billing lifecycle change.