feat(auth): add local user signup, email verification, and Stripe billing

- Add LocalUser model with bcrypt password hashing, email verification
  tokens, and password reset tokens
- Add ALLOW_LOCAL_SIGNUP config flag (requires SMTP to be configured)
- Add Stripe billing config fields (STRIPE_SECRET_KEY, etc.)
- Add stripe_customer_id to UserProfile and stripe_price_id_monthly/
  stripe_price_id_yearly to SubscriptionPlan
- Create migration 018_add_local_users_and_billing
- Add app/utils/local_auth.py: hash_password, verify_password,
  generate_token, is_token_expired, send_verification_email,
  send_password_reset_email, build_session_user
- Add app/api/local_auth.py: signup, email verification, password reset
  endpoints plus signup/verify-email-sent/reset-password page routes
- Add app/api/billing.py: Stripe Checkout, Customer Portal, and webhook
  endpoints; syncs subscription tier from webhook events
- Update auth() to check LocalUser table before admin credentials fallback
- Update login() to pass allow_signup context variable to template
- Add signup.html, verify_email_sent.html, password_reset_form.html,
  billing_success.html templates (Alpine.js, Tailwind, WCAG 2.1 AA)
- Update login.html to show 'Create account' link when signup enabled
- Update pricing.html CTA buttons to use Stripe Checkout for paid tiers
- Add docs/BillingSetup.md with setup guide, webhook config, compliance
- Add tests/test_local_auth.py (42 tests) and tests/test_billing.py
  (31 tests); all 106 tests in the modified test suite pass
- Add stripe>=7.0.0,<15.0.0 to requirements.txt

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

migrations/versions/018_add_local_users_and_billing.py

@@ -0,0 +1,49 @@
+"""Add local_users table and billing columns
+
+Revision ID: 018_add_local_users_and_billing
+Revises: 017_add_onboarding_fields
+Create Date: 2026-03-09
+"""
+
+from typing import Union
+
+import sqlalchemy as sa
+from alembic import op
+
+revision: str = "018_add_local_users_and_billing"
+down_revision: Union[str, None] = "017_add_onboarding_fields"
+depends_on: Union[str, None] = None
+
+
+def upgrade() -> None:
+    """Create local_users table and add billing columns."""
+    op.create_table(
+        "local_users",
+        sa.Column("id", sa.Integer(), nullable=False),
+        sa.Column("email", sa.String(255), nullable=False),
+        sa.Column("username", sa.String(64), nullable=False),
+        sa.Column("display_name", sa.String(255), nullable=True),
+        sa.Column("hashed_password", sa.String(255), nullable=False),
+        sa.Column("is_active", sa.Boolean(), nullable=False, server_default="0"),
+        sa.Column("is_admin", sa.Boolean(), nullable=False, server_default="0"),
+        sa.Column("email_verification_token", sa.String(128), nullable=True),
+        sa.Column("email_verification_sent_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("password_reset_token", sa.String(128), nullable=True),
+        sa.Column("password_reset_sent_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now()),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), onupdate=sa.func.now()),
+        sa.PrimaryKeyConstraint("id"),
+        sa.UniqueConstraint("email"),
+        sa.UniqueConstraint("username"),
+    )
+    op.add_column("user_profiles", sa.Column("stripe_customer_id", sa.String(64), nullable=True))
+    op.add_column("subscription_plans", sa.Column("stripe_price_id_monthly", sa.String(64), nullable=True))
+    op.add_column("subscription_plans", sa.Column("stripe_price_id_yearly", sa.String(64), nullable=True))
+
+
+def downgrade() -> None:
+    """Reverse the migration."""
+    op.drop_column("subscription_plans", "stripe_price_id_yearly")
+    op.drop_column("subscription_plans", "stripe_price_id_monthly")
+    op.drop_column("user_profiles", "stripe_customer_id")
+    op.drop_table("local_users")