feat: Phase 4 module auto-installation + Phase 5 webstore backend

Phase 4 Contributions (Agent Golf):
- Module auto-installation service (module_installer.rs)
- NATS subject pattern for module installation commands
- Companion agent contract documentation
- API endpoint: POST /api/modules/install

Phase 5 XO Direct Touch:
- Webstore subscription API (PayPal recurring billing)
  * POST /api/webstore/subscription/create
  * GET /api/webstore/subscription
  * POST /api/webstore/subscription/cancel
  * POST /api/webstore/subscription/webhook
- Store configuration API (CRUD for store settings)
  * GET /api/webstore/config
  * PUT /api/webstore/config
- Store category/item management APIs (multi-tenant CRUD)
  * GET/POST/PUT/DELETE /api/webstore/categories
  * GET/POST/PUT/DELETE /api/webstore/items
- Public store API (customer-facing, subdomain-scoped)
  * GET /api/public-store/:subdomain
  * GET /api/public-store/:subdomain/items
  * POST /api/public-store/:subdomain/purchase
  * POST /api/public-store/:subdomain/webhook
- Transaction history API
  * GET /api/webstore/transactions
- Delivery system (NATS command execution on purchase)
- Migrations: payment_orders, webstore_subscriptions, store_config, store_items, store_transactions

Security:
- JWT auth + license_id scoping on admin endpoints
- Subdomain → license_id mapping on public endpoints
- Purchase limit enforcement
- Command injection prevention via placeholder replacement

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

backend/migrations/011_webstore_tables.sql

@@ -0,0 +1,92 @@
+-- Phase 5: Integrated Webstore Tables
+
+-- Webstore subscriptions (license activation for webstore feature)
+CREATE TABLE IF NOT EXISTS webstore_subscriptions (
+    id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    license_id UUID UNIQUE NOT NULL REFERENCES licenses(id) ON DELETE CASCADE,
+    paypal_subscription_id VARCHAR(255) UNIQUE NOT NULL,
+    plan_id VARCHAR(100) NOT NULL,  -- 'basic' ($10/mo), 'pro' ($25/mo), etc.
+    status VARCHAR(50) NOT NULL,  -- 'active', 'cancelled', 'suspended', 'past_due'
+    current_period_start TIMESTAMPTZ NOT NULL,
+    current_period_end TIMESTAMPTZ NOT NULL,
+    cancelled_at TIMESTAMPTZ,
+    created_at TIMESTAMPTZ DEFAULT NOW()
+);
+
+-- Store configuration
+CREATE TABLE IF NOT EXISTS store_config (
+    id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    license_id UUID UNIQUE NOT NULL REFERENCES licenses(id) ON DELETE CASCADE,
+    store_name VARCHAR(200) NOT NULL,
+    description TEXT,
+    currency VARCHAR(3) DEFAULT 'USD',
+    paypal_client_id VARCHAR(255),  -- Customer's PayPal credentials
+    paypal_client_secret TEXT,  -- Encrypted
+    sandbox_mode BOOLEAN DEFAULT true,
+    enabled BOOLEAN DEFAULT false,
+    created_at TIMESTAMPTZ DEFAULT NOW(),
+    updated_at TIMESTAMPTZ DEFAULT NOW()
+);
+
+-- Store categories
+CREATE TABLE IF NOT EXISTS store_categories (
+    id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    license_id UUID NOT NULL REFERENCES licenses(id) ON DELETE CASCADE,
+    name VARCHAR(100) NOT NULL,
+    slug VARCHAR(100) NOT NULL,
+    description TEXT,
+    display_order INTEGER DEFAULT 0,
+    visible BOOLEAN DEFAULT true,
+    created_at TIMESTAMPTZ DEFAULT NOW(),
+    UNIQUE(license_id, slug)
+);
+
+-- Store items
+CREATE TABLE IF NOT EXISTS store_items (
+    id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    license_id UUID NOT NULL REFERENCES licenses(id) ON DELETE CASCADE,
+    category_id UUID REFERENCES store_categories(id) ON DELETE SET NULL,
+    name VARCHAR(200) NOT NULL,
+    description TEXT,
+    price DECIMAL(10,2) NOT NULL,
+    image_url TEXT,
+    item_type VARCHAR(50) NOT NULL,  -- 'kit', 'rank', 'currency', 'command'
+    delivery_commands JSONB NOT NULL,  -- Array of console commands to execute on purchase
+    limit_per_player INTEGER,  -- NULL = unlimited
+    enabled BOOLEAN DEFAULT true,
+    created_at TIMESTAMPTZ DEFAULT NOW(),
+    updated_at TIMESTAMPTZ DEFAULT NOW()
+);
+
+-- Store transactions
+CREATE TABLE IF NOT EXISTS store_transactions (
+    id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    license_id UUID NOT NULL REFERENCES licenses(id) ON DELETE CASCADE,
+    item_id UUID REFERENCES store_items(id) ON DELETE SET NULL,
+    steam_id VARCHAR(20) NOT NULL,
+    player_name VARCHAR(100),
+    paypal_order_id VARCHAR(255) UNIQUE NOT NULL,
+    paypal_transaction_id VARCHAR(255),
+    amount DECIMAL(10,2) NOT NULL,
+    currency VARCHAR(3) DEFAULT 'USD',
+    status VARCHAR(50) NOT NULL,  -- 'pending', 'paid', 'delivered', 'failed', 'refunded'
+    delivered BOOLEAN DEFAULT false,
+    delivered_at TIMESTAMPTZ,
+    payer_email VARCHAR(255),
+    created_at TIMESTAMPTZ DEFAULT NOW()
+);
+
+CREATE INDEX idx_webstore_subscriptions_license ON webstore_subscriptions(license_id);
+CREATE INDEX idx_store_config_license ON store_config(license_id);
+CREATE INDEX idx_store_categories_license ON store_categories(license_id);
+CREATE INDEX idx_store_items_license ON store_items(license_id);
+CREATE INDEX idx_store_items_category ON store_items(category_id);
+CREATE INDEX idx_store_transactions_license ON store_transactions(license_id);
+CREATE INDEX idx_store_transactions_steam ON store_transactions(steam_id);
+CREATE INDEX idx_store_transactions_status ON store_transactions(status);
+
+COMMENT ON TABLE webstore_subscriptions IS 'Phase 5: PayPal subscriptions for webstore feature access';
+COMMENT ON TABLE store_config IS 'Phase 5: Per-license webstore configuration';
+COMMENT ON TABLE store_categories IS 'Phase 5: Store item categories (VIP Kits, Ranks, etc.)';
+COMMENT ON TABLE store_items IS 'Phase 5: Products for sale in customer webstores';
+COMMENT ON TABLE store_transactions IS 'Phase 5: Purchase history and delivery tracking';