Add multi-tenant cloud mode: self-serve purchase, credit metering, core-decoupling

Introduces RECAP_MODE=multi alongside single-mode self-host:
- Tenant auth + accounts (magic-link via System SMTP), per-tenant credit pool,
  anonymous trial minting with per-IP/-64 caps
- Self-serve Pro/Max purchase: inline Lightning (BTCPay) + card (Zaprite),
  prepaid 30-day periods, expiry-reminder emails
- Core-decoupling: relay owns cloud tier/expiry keyed by Recaps user-id
- SQLite (better-sqlite3) schema for multi-mode; filesystem unchanged for single
- StartOS actions/versions through 0.2.155

startos/actions/setReplenishPeriod.ts

@@ -0,0 +1,73 @@
+import { sdk } from '../sdk'
+import { configFile } from '../file-models/config.json'
+
+const { InputSpec, Value } = sdk
+
+// How often to refresh tenants' replenishable credit bucket. The
+// bucket size itself is set via "Set Default Tenant Credits" — this
+// action just controls WHEN it gets refilled.
+//
+// Refresh semantics: replenish_balance is RESET to
+// tenant_default_credits at each anniversary boundary. Any leftover
+// from the previous period is forfeit (use-it-or-lose-it). Purchased
+// credits + admin grants live in a SEPARATE bucket
+// (tenant_credits.purchased_balance) that's never wiped by refills.
+//
+// Spend order is replenish first, then purchased — so a tenant
+// burns through the refillable bucket each period before touching
+// their permanent balance.
+//
+// Anniversary alignment: refills are anchored to each tenant's
+// individual last_replenish_at timestamp (set when they signed up,
+// or when the operator first switched this action on). A user who
+// signed up at 3:17pm gets their daily refresh at 3:17pm each day,
+// not at calendar midnight.
+const inputSpec = InputSpec.of({
+  period: Value.select({
+    name: 'Replenishment period',
+    description:
+      'How often each tenant\'s replenishable credit bucket gets refilled to the configured default. Set to "off" for a one-time signup grant (Grant\'s use case — tenants are paying customers and don\'t get free daily refills). Set to daily/weekly/monthly for a free-tier-with-daily-allowance model.',
+    default: 'off',
+    values: {
+      off: "Off (one-time signup grant only)",
+      daily: 'Daily (every 24 hours)',
+      weekly: 'Weekly (every 7 days)',
+      monthly: 'Monthly (calendar month)',
+    },
+  }),
+})
+
+export const setReplenishPeriod = sdk.Action.withInput(
+  'set-replenish-period',
+
+  async ({ effects }) => ({
+    name: 'Set Tenant Credit Replenishment',
+    description:
+      "How often a tenant's free credit bucket refills (uses Set Default Tenant Credits as the refill amount). Off = no replenishment; their initial signup grant is one-time. Daily/Weekly/Monthly = anniversary-aligned refill of the replenishable bucket. Purchased credits never expire.",
+    warning: null,
+    allowedStatuses: 'any',
+    group: 'Multi-Tenant',
+    visibility: 'enabled',
+  }),
+
+  inputSpec,
+
+  async ({ effects }) => {
+    const config = await configFile.read().once()
+    return {
+      period:
+        (config?.tenant_credit_replenish_period as
+          | 'off'
+          | 'daily'
+          | 'weekly'
+          | 'monthly') || 'off',
+    }
+  },
+
+  async ({ effects, input }) => {
+    await configFile.merge(effects, {
+      tenant_credit_replenish_period: input.period,
+    })
+    return null
+  },
+)