Redeem a one-time license key, and bind it to the account when we know it.

Two writes, one act. licenses/{key}.redeemed_by is the one-time record (claimed inside an optimistic Firestore transaction — check and claim are one atomic step, so a concurrent second redeem 409s instead of binding the paid key twice); users/{uid}.licenseKey is the bind _get_tier reads on the Bearer path, so a redeemed license elevates every later request from that account with no X-License-Key header. Authorization: Bearer <idToken> is therefore how a non-browser client (CLI, agent, script) redeems without ever opening the SPA.

Three deliberate rules, each one a way the bind would otherwise not happen or could not be revoked:

• The verified uid outranks the body's principal. A token is proof; a body field is a claim. Using the proof for the one-time record too keeps redemption and bind naming the same account.
• An anon: redemption can be displaced by a verified caller. Those principals are User-Agent slices the client invents, so they prove nothing and cannot own a license against an account — which is what a visitor who redeems before signing in, then signs in, would otherwise be stuck with. A real principal (a uid, an operator-chosen string) stays immutable.
• Fail-open on the bind. The license is already redeemed by then; a Firestore hiccup returns bound: false, never a 500.