AUTH4D-34 billing persistence boundary

This ticket adds the D1 billing schema and no public HTTP routes. Billing endpoints and webhook handling are specified by their owning tickets.

• Billing accounts, subscriptions, invoices, payments and provider events are tenant-scoped through tenant_id and composite tenant/entity foreign keys.
• Money is stored as integer minor units with an ISO 4217 currency code. Clients never supply price or entitlement data.
• Provider webhooks are idempotent on (provider, provider_event_id). A payment is located by its globally unique external_reference or provider_payment_id.
• No card data, secrets, raw webhook bodies or signature headers are persisted.

See D1 schema operations (repository file docs/operations/d1-schema.md) for table details.