Internal-only: billing maintenance. Runs, in order:

1. Token grant expiration (expires_at in the past → zero remaining).
2. Yearly subscription monthly drips (next_cron_grant <= today).
3. Storage quota reset to default for lapsed subscriptions (period ended and status is not active / trialing).
4. Removal of enterprise subscriptions whose period has ended.

All steps share one DB transaction. Called once per day by cron_job_daily; kept as its own route so it can be driven by hand. Idempotent for expirations within a day; yearly drips advance next_cron_grant so the same day does not double-grant.