Billing Subscriptions

Every currently-active subscription, ONE per research domain (omics, humanities_social, ...), each with its own expires_at / auto_renew / cancelled_at.

This is the per-domain source of truth for the client's on-app-open expiry reminder: the flat domain_plans token claim carries only the tier, and /api/auth/plan_token's expires_at is the 24h token TTL — neither reflects the actual membership expiry.