feat(payments): fix Polar webhook + pre-fill checkout email

- Fix customer email path: was data.customer_email, is actually
  data.customer.email per Polar v1 API schema
- Add resolveUser() helper: tries polar_customer_id → email → external_id
- Add subscription.active and subscription.canceled event handling
- Handle order.created for fast-path pro upgrade on purchase
- Profile page: fetch user email + polarCustomerId from PocketBase
- Profile page: pre-fill ?customer_email= on checkout links
- Profile page: link to polar.sh/purchases for existing customers

ui/src/routes/profile/+page.server.ts

@@ -10,24 +10,31 @@ export const load: PageServerLoad = async ({ locals }) => {
 	}
 
 	let sessions: Awaited<ReturnType<typeof listUserSessions>> = [];
-	try {
-		sessions = await listUserSessions(locals.user.id);
-	} catch (e) {
-		log.warn('profile', 'listUserSessions failed (non-fatal)', { err: String(e) });
-	}
+	let email: string | null = null;
+	let polarCustomerId: string | null = null;
 
 	// Fetch avatar — MinIO first, fall back to OAuth provider picture
 	let avatarUrl: string | null = null;
 	try {
 		const record = await getUserByUsername(locals.user.username);
 		avatarUrl = await resolveAvatarUrl(locals.user.id, record?.avatar_url);
+		email = record?.email ?? null;
+		polarCustomerId = record?.polar_customer_id ?? null;
 	} catch (e) {
 		log.warn('profile', 'avatar fetch failed (non-fatal)', { err: String(e) });
 	}
 
+	try {
+		sessions = await listUserSessions(locals.user.id);
+	} catch (e) {
+		log.warn('profile', 'listUserSessions failed (non-fatal)', { err: String(e) });
+	}
+
 	return {
 		user: locals.user,
 		avatarUrl,
+		email,
+		polarCustomerId,
 		sessions: sessions.map((s) => ({
 			id: s.id,
 			user_agent: s.user_agent,