Add multi-tenant cloud mode: self-serve purchase, credit metering, core-decoupling

Introduces RECAP_MODE=multi alongside single-mode self-host:
- Tenant auth + accounts (magic-link via System SMTP), per-tenant credit pool,
  anonymous trial minting with per-IP/-64 caps
- Self-serve Pro/Max purchase: inline Lightning (BTCPay) + card (Zaprite),
  prepaid 30-day periods, expiry-reminder emails
- Core-decoupling: relay owns cloud tier/expiry keyed by Recaps user-id
- SQLite (better-sqlite3) schema for multi-mode; filesystem unchanged for single
- StartOS actions/versions through 0.2.155

startos/versions/v0.2.90.ts

@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_90 = VersionInfo.of({
+  version: '0.2.90:0',
+  releaseNotes: {
+    en_US: 'Anonymous credit purchase. Anon visitors can now buy more credits without signing up — the credits attach to their browser\'s trial cookie and transfer to their account if/when they sign up. New SQLite table pending_purchases tracks {invoice_id, buyer_type, buyer_id, credits} so the settle handler in /api/credits/invoice/:id knows where to apply the credits locally (anon_trials.credits_total for trial cookies, tenant_credits.balance for signed-in users). Idempotent via applied_at — duplicate polls don\'t double-credit. linkToUser (called from /auth/verify on magic-link signin) now transfers any unused trial credits into the new user\'s tenant_credits.balance. The buy modal for anon shows a callout reminding them to sign up to save credits across devices. Smoke-tested end-to-end: anon with 1 trial credit + 10 purchased → spends 3 → signs up → ends with 8 credits in their new tenant_credits.balance.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})