fix(api): tier upgrade promotes team default TTL + auto_24h deploys (P1)

[mastermanas805]

Summary

P1 user-visible bug. A Pro-tier user got an "expires in 6 hours" email the day after upgrading free→pro. Root cause: the Razorpay subscription.charged webhook called UpgradeTeamAllTiers but never touched teams.default_deployment_ttl_policy — so every NEXT POST /deploy/new still inherited auto_24h and re-fired the 24h-expiry reminder cycle.

• New models.PromoteDeploymentTTLsForTeam(ctx, db, teamID) (PromoteDeploymentTTLsResult, error) — single tx that (a) flips teams.default_deployment_ttl_policy auto_24h → permanent (user-explicit non-auto defaults are LEFT UNTOUCHED), and (b) promotes every non-terminal ttl_policy='auto_24h' deploy to permanent + clears expires_at + resets the reminders ledger. Custom + already-permanent rows are LEFT UNTOUCHED.
• Wired into handleSubscriptionCharged for tiers >= hobby (anonymous / free skip the promote path). Fail-open: a promote error never 500s the webhook — the upgrade tx has already committed and the operator runs the idempotent cmd/backfill-tier-ttl to repair the residual.
• Audit row team.ttl_policies_promoted (operator-only, no customer email — the subscription.upgraded email already covers customer comms) + metric instant_tier_upgrade_ttl_promote_total{outcome=success|noop|error}.
• Companion infra PR adds the Prom rule + NR alert + dashboard tile + METRICS-CATALOG row (rule 25): https://github.com/InstaNode-dev/infra/pull/new/fix/observability-tier-upgrade-ttl-promote
• Companion content PR documents the new auto-promote behavior in llms.txt: https://github.com/InstaNode-dev/content/pull/new/docs/llms-tier-upgrade-ttl-promote

Coverage block (CLAUDE.md rule 17)

Symptom:        team.default stays 'auto_24h' + auto_24h deploys keep
                firing "expires in N hours" emails after paid upgrade
Enumeration:    rg -F 'UpdatePlanTier' / 'UpgradeTeamAllTiers' /
                'default_deployment_ttl_policy'
Sites found:    4 paid-tier mutation paths (Razorpay webhook,
                /internal/set-tier dev-only, admin tier-change,
                PATCH /api/v1/team/settings)
Sites touched:  1 — the Razorpay webhook is the ONLY paid-tier
                promotion path. set-tier is dev-only (skipped per spec
                anti-goal). Admin demote keeps existing state by design.
                Team-settings is the user's own override and must not
                trigger promote.
Coverage test:  e2e/reliability_contract_test.go's audit-kinds registry
                iterator (rule 18) flags any new AuditKind* constant
                without a downstream-consumer entry, and
                TestPlansRegistryUpgradeTargets_AllInvokePromoteGuard
                iterates plans.Registry so a new tier landing between
                free and hobby loudly fails the guard.
Live verified:  awaiting user verification of the next paid upgrade —
                the new NR alert (tier-upgrade-ttl-promote-failed) pages
                on any outcome=error tick within 10m.

Backfill (operator action — one-off after deploy)

DATABASE_URL=$(kubectl get secret -n instant instant-secrets -o jsonpath='{.data.DATABASE_URL}' | base64 -d) \
  go run ./cmd/backfill-tier-ttl -apply

Default mode is dry-run. The function is idempotent — safe to re-run for any residual after a partial failure.

Test plan

• make gate — new tests pass; remaining failures are pre-existing (customer-DB proxy / NATS service not present on local laptop — known per Makefile docstring). Confirmed by stash-test on master baseline.
• go test -run 'TestPromoteDeploymentTTLs|TestPlansRegistryUpgradeTargets|TestBillingWebhook_ChargedPromotesTeamDefaultAndDeploys|TestBillingWebhook_ChargedDoesNotPromoteOnSameTierRenewal|TestReliability_AuditKinds_EveryConstantHasConsumerSpec' ./internal/models ./internal/handlers ./e2e → ok.
• Post-deploy: build-SHA gate via curl https://api.instanode.dev/healthz | jq .commit_id.
• Operator runs cmd/backfill-tier-ttl -apply once against prod (DRY-RUN first).
• Verify on the affected user: re-check their team default + deploys are now permanent.

🤖 Generated with Claude Code