test: cover purchases + subscription business logic (real code)

Commit notes

Adds unit tests for the pure, security- and money-sensitive logic exported from the payments services, exercised against the actual modules:

- purchases.isValidRedirectUrl: open-redirect guard for checkout/portal redirects — covers trusted-host allow paths plus deny paths (external domains, look-alike subdomains, dev-only ports, javascript: scheme, malformed input). - purchases.MIN_PAYOUT_AMOUNT_CENTS: payout floor. - subscription.getStorageLimitForPlan + STORAGE_LIMITS/PRICING: tier invariants (free<pro<team, monthly==yearly storage, annual discount yearly<12x monthly, all prices positive) rather than brittle magic numbers.

These confirm the service modules import cleanly under the test runner (lazy DB connection, no live Postgres/Redis required). Full suite green: 176 pass / 0 fail.