Buy Foundations through RevenueCat, and let entitlement expire - #602

Why

The app could not take money. This builds the store behind all three pricing
arms — #421, which stays open until the sandbox criteria can actually be run.
The ruling is ADR-0024,
which supersedes ADR-0003.

Watch for

• None of this has met a real store. It is written against the
  purchases_flutter API and compiles, but no call has run against RevenueCat
  or StoreKit. Every judgement below is unverified until the account work in
  docs/10-payments.md is done.
• Which plan an owner holds is asked of the store, through a new
  activeTerm() on the seam, rather than read from PurchasedTerm — which
  records only what this session bought, and so called a returning
  subscriber a one-time buyer. Purchases now draws nothing until the store has
  named the plan; a beat of blank beats a wrong plan. A SKU this build does
  not know reads as bought outright, which is the reading that offers nothing
  to cancel.
• purchaseUpdates is gone, replaced by entitlementChanges. It had no
  consumer anywhere in lib/; the stream that was actually needed is the one
  that reports a lapse.
• The Purchases body lives in features/monetization/, not profile/.
  The payments seam guard forbids anything outside the paywall layer reading
  which arm a learner is on, and this screen's copy changes per arm. The
  Settings file is the frame only.
• Offline falls back to the last known answer. RevenueCat serves cached
  customer info, so a throw means it has never answered; guessing false
  there would lock out a paying learner.
• GRANT_COURSE wins over REVENUECAT_KEY when both are passed, so a
  development build that asked for the owned state still gets it.

Not here

• Registering the products, the RevenueCat account, the Xcode capability and
  the sandbox tester. Owner-only; the list is in docs/10-payments.md and
  Make the purchase real, through RevenueCat #421 holds them.
• The four sandbox acceptance criteria on Make the purchase real, through RevenueCat #421, which need that account work
  before anyone can tick them.

Checks

• flutter test — 3197 pass, 15 new.
• The expiry test was checked against a deliberately broken build first: with
  the change-stream watch removed it fails Expected: false, Actual: true.
• Metrics, format, comment cap, guard tests and the changelog check all ran in
  the pre-push hook.
• SPM resolves purchases-ios-spm 5.88.0, so the Podfile-free iOS setup
  survives the new dependency.