Reconcile the caller's Apple entitlement from Apple's authoritative server state — the pull complement to /verify's push.

Use when a client push never landed (a StoreKit receipt race, a lost request) so the local entitlement is missing while Apple still shows an active subscription. Given any transaction id in the user's chain, we pull the subscription's current transactions from the App Store Server API and (re)apply the ACTIVE one.

Unlike /verify's proof-possession path, repair only grants a transaction whose Apple-signed appAccountToken is present (positive attribution); apply_verified_transaction then enforces it resolves to this user, so knowing a stranger's transaction id can never claim their subscription. Idempotent: apply uses an absolute expiry, so repeated repairs never add a period.