feat(ecommerce): add subscriptions, discount engine, gift cards, digi…

[ionutpasca]

Summary

• Add ecommerce subscriptions end-to-end: UIDL settings, storefront provider wiring, recurring cart/totals, and payment nodes (ensure-subscription-plan, manage-subscription, billing-portal) replacing the old create/subscribe/cancel plan nodes.
• Add subscriber-only page/workflow protection (requiresSubscription / subscriptionProductIds) with shared entitlement SQL, /api/auth/subscriber-access, and middleware/workflow-auth guards.
• Ship the discount engine (vouchers + stacking + automatic rules) and gift cards as tender, mirrored into cart-get-total / checkout so editor, storefront, and place-order stay cent-aligned.
• Add digital product downloads (/api/downloads/[fileId]) with order-key + session entitlement checks, plus table access guards so money/customer tables stay off browser data APIs (trusted-role / server-segment only).
• Harden related workflow/data-source plumbing (session cookie resolver, refund/charge paths, protected-table SQL guards, segment state-key handling) and cover with new/updated unit tests.

Test plan

• Generate a store with subscriptions enabled; confirm recurring products only offer subscription-capable providers and checkout creates/manages plans correctly
• Protect a page with requiresSubscription; verify middleware + workflow routes allow entitled statuses (trialing/active/past_due) and redirect/deny otherwise
• Enable discount engine + gift cards; confirm cart summary, cart-get-total, and place-order discount/tender amounts match
• Enable digital products; verify download links work for the owning paid order and fail for bad key / other account / revoked refund policy
• Hit browser data/read routes for money & customer tables → denied; trusted admin / server workflow segments still succeed
• Run targeted packages: teleport-shared, teleport-plugin-next-workflows, teleport-plugin-next-data-source, teleport-project-generator-next tests