feat(billing): Polar.sh Pro subscription integration

- Webhook handler verifies HMAC-SHA256 sig and updates user role on
  subscription.created / subscription.updated / subscription.revoked
- Audio endpoint gated: free users limited to 3 chapters/day via Valkey
  counter; returns 402 {error:'pro_required'} when limit reached
- Translation proxy endpoint enforces 402 for non-pro users
- AudioPlayer.svelte surfaces 402 via onProRequired callback + upgrade banner
- Chapter page shows lock icon + upgrade prompts for gated translation langs
- Profile page: subscription section shows Pro badge + manage link (active)
  or monthly/annual checkout buttons (free); isPro resolved fresh from DB
- i18n: 13 new profile_subscription_* keys across all 5 locales

ui/src/hooks.server.ts

@@ -6,7 +6,7 @@ import { randomBytes, createHmac } from 'node:crypto';
 import { env } from '$env/dynamic/private';
 import { env as pubEnv } from '$env/dynamic/public';
 import { log } from '$lib/server/logger';
-import { createUserSession, touchUserSession, isSessionRevoked } from '$lib/server/pocketbase';
+import { createUserSession, touchUserSession, isSessionRevoked, getUserById } from '$lib/server/pocketbase';
 import { drain as drainPresignCache } from '$lib/server/presignCache';
 import { NodeSDK } from '@opentelemetry/sdk-node';
 import { OTLPTraceExporter } from '@opentelemetry/exporter-trace-otlp-http';
@@ -210,6 +210,18 @@ const appHandle: Handle = async ({ event, resolve }) => {
 		event.locals.user = null;
 	}
 
+	// ── isPro: read fresh from DB so role changes take effect without re-login ──
+	if (event.locals.user) {
+		try {
+			const dbUser = await getUserById(event.locals.user.id);
+			event.locals.isPro = dbUser?.role === 'pro' || dbUser?.role === 'admin';
+		} catch {
+			event.locals.isPro = false;
+		}
+	} else {
+		event.locals.isPro = false;
+	}
+
 	return resolve(event);
 };