feat(retention): a lapsed subscription loses the features, not the history

[lilyshen0722]

Sam's call: "at time of expiry, we shouldn't immediately remove their message,
we should keep another 30 days."

Right, and the trigger is worse than deliberate cancellation. statusGrantsPro
returns false for past_due, so one failed card payment flips the
entitlement — and #878's protection disappears with it, meaning that night's
retention run permanently deletes everything older than 30 days. Before the
customer has read the dunning email. With nothing to recover if they fix the
card the next morning.

That is the worst possible moment to be destructive. A lapsed customer is
exactly who you want back; winning them back is impossible once their history
is gone; holding the bytes another month costs almost nothing.

Shape

Features stop immediately. Data gets a grace window. The entitlement still
flips to false at once, so Community listing and the rest lock the same
instant — the grace covers bytes, not access. There's a test pinning that
split, because it would be easy to "fix" this by leaving pro true and
accidentally give away the paid features for a month.

billing.proEndedAt is the clock, stamped by applySubscriptionState on the
true → false edge only. Stripe retries for three days and dunning fires
repeatedly; re-stamping on every past_due would walk the deadline forward
forever and the history would never be reclaimed. Cleared on re-subscribe, so
a later lapse gets a fresh window rather than an expired one.

Two deliberate choices

The window is not derived from PG_MESSAGE_RETENTION_DAYS. That window is
the free tier's product; this one is a win-back runway. Tying them would mean
that squeezing free-tier storage silently shortens a paying customer's grace.

A malformed PRO_DATA_GRACE_DAYS falls back to 30, not 0. The failure mode
of that particular typo is deleting a paying customer's history tonight, so it
fails toward keeping data. Tested.

Verification

Nine tests across both services. Reverted the change and confirmed six fail.
71 billing + retention tests pass, typecheck clean.

Related: #875, #877, #878.