Admin Manage Subscriptions page with pause, resume, and cancel actions (#1444)

* feat: add ISubscriptionHandlerService with billable subscription listing

- Create ISubscriptionHandlerService interface with ListBillableAsync method
- Implement StripeSubscriptionHandlerService with pagination and customer expansion
- Filter subscriptions to only billable statuses (active, past_due, trialing, unpaid)
- Exclude canceled subscriptions from results
- Register service in DI container
- Add comprehensive unit tests covering filtering and expansion behavior

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat: pause and resume Stripe subscriptions by id

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat: cancel Stripe subscriptions by id (at period end or immediately)

Implements CancelAtPeriodEndAsync and CancelImmediatelyAsync on StripeSubscriptionHandlerService. CancelAtPeriodEndAsync sets CancelAtPeriodEnd=true to defer cancellation until the subscription's current billing period ends. CancelImmediatelyAsync calls Stripe's cancel endpoint to immediately terminate the subscription.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat: add StripeSubscriptionDto and AutoMapper profile

Implement web-layer DTO and AutoMapper profile for mapping Stripe.Subscription objects to StripeSubscriptionDto. The profile handles nested property extraction (customer email, plan details, pricing) and null-conditional chaining for optional fields. Stripe amounts in cents are converted to decimal dollars via division by 100.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat: add admin Manage Subscriptions page listing billable subscriptions

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix: enhance ManageSubscriptions test to verify ordering and mapping

Strengthen test to verify subscriptions are ordered by CustomerEmail then Id,
and to assert mapped fields end-to-end. Test now provides subscriptions in
non-sorted order with same-email pair to exercise ThenBy tie-break logic.
Would fail if OrderBy/ThenBy calls were removed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat: pause, resume, and cancel actions on Manage Subscriptions page

Implement POST handlers for subscription actions (pause, resume, cancel at period
end, cancel immediately) on the Manage Subscriptions admin page. Add action
buttons to the UI with confirmation dialogs. Add the Manage Subscriptions link
to the admin menu. Includes test class for handlers (discovery issue pending).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Fix XSS/loop/webhook findings from Manage Subscriptions review

- Remove member-controlled data (CustomerEmail, subscription Id) from
  onsubmit confirm() JS strings in ManageSubscriptions/Index.cshtml.
  Razor HTML-encoding is decoded by the HTML parser before the JS
  engine sees it, so a literal apostrophe (e.g. o'brien@example.com)
  reached the JS string context, silently skipping confirmation
  (including for irreversible Cancel Now) or enabling stored XSS in
  the admin session. Confirm messages are now static.
- Fix CustomerSubscriptionUpdatedWebHook comparing stripeEvent.Type
  against EventTypes.CustomerUpdated ("customer.updated") instead of
  EventTypes.CustomerSubscriptionUpdated ("customer.subscription.updated"),
  which made the endpoint reject every real event it receives with an
  uncaught 500.
- Harden StripeSubscriptionHandlerService.ListBillableAsync's pagination
  loop against an infinite loop if Stripe ever returns HasMore=true with
  an empty Data page.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: ardalis