feat: Google sign-in via Clerk and per-user Stripe billing

[GeorgePearse]

Summary

Adds authentication (Google sign-in) and per-user subscription billing to the Genesis WebUI, following the plan outlined in the README's "Hosted Auth and Payments Plan" section.

Changes

Authentication (Clerk)

• Frontend: ClerkProvider wraps the app in main.tsx; SignedIn/SignedOut gates in App.tsx show a sign-in page when unauthenticated
• Server: clerkMiddleware() + requireAuth() on all data routes in server/index.ts

Billing (Stripe)

• server/billing.ts: Stripe Checkout session creation, Billing Portal session creation, and webhook handler for checkout.session.completed, customer.subscription.updated, customer.subscription.deleted
• BillingGate.tsx: Frontend component that checks subscription status and redirects to Stripe Checkout if no active subscription exists

User/Subscription Database

• migrations/001_users_subscriptions.sql: Postgres schema with users and subscriptions tables
• server/db.ts: Connection pool and CRUD queries via pg

Server Gateway

• All data API routes require both a valid Clerk session AND an active Stripe subscription
• Billing routes (/api/billing/*) require auth but not a subscription
• Stripe webhook (/api/webhooks/stripe) is exempt from both (verified by signature)

Environment

• .env.example updated with VITE_CLERK_PUBLISHABLE_KEY, CLERK_SECRET_KEY, STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET, STRIPE_PRICE_ID, DATABASE_URL, APP_URL

User Flow

1. User visits app -> sees "Continue with Google" sign-in button
2. Clerk handles Google OAuth -> authenticated session
3. No active subscription -> redirected to Stripe Checkout
4. Stripe webhook fires -> subscription marked active in DB
5. Subsequent requests pass auth + subscription checks -> app loads

Setup Required

1. Create a Clerk project and enable the Google social connection
2. Create a Stripe product + price, and configure the Billing Portal
3. Set up a Postgres database and run migrations/001_users_subscriptions.sql
4. Fill in the env vars from .env.example

Verification

• tsc -b passes cleanly
• oxlint src reports 0 warnings, 0 errors
• vite build succeeds