Reconcile the subscription against Dodo

Fetches the workspace's subscription facts from Dodo and updates the local mirror: status, plan, renewal date, cancellation flag — and which subscription the workspace even has, matched via checkout metadata when the mirror never learned of a purchase. Webhooks remain the only path that grants credits; this syncs facts, which are idempotent. The client calls it after returning from checkout and on billing-page load, so the page is truthful even where webhooks cannot reach (local development) or have not arrived yet (production).