Cancel renewal — claude/codex-style "stop my subscription".

No money moves: the current period continues working until expires_at, at which point the hourly expire_due_subscriptions cron demotes the user to community as it would have anyway. The behavior change is purely UI:

• cancelled_at gets a timestamp so the SPA can render the cancelled state ("已取消，<date> 到期后变为 Free") instead of the open-ended "active".
• auto_renew is flipped FALSE for future-proofing (a hosted WeChat Pay 协议支付 / Alipay 周期扣款 product would gate on this).

Idempotent — cancelling a sub that is already cancelled is a no-op and returns the same payload.