feat(mana-sync): per-app billing exemption — Cards bypasses sync gate

mana-sync's billing middleware short-circuited every push/pull with
402 for users without a sync subscription. Cards promises free Sync
in its Phase-1 GUIDELINES, so it shouldn't gate its own users on a
mana-credits subscription it never sells.

Implementation:
  • billing.NewChecker now takes an exemptApps slice. The middleware
    extracts {appId} from the URL path and short-circuits before the
    user lookup if the app is in the set.
  • Configurable via the BILLING_EXEMPT_APPS env var (comma-separated).
  • Set BILLING_EXEMPT_APPS=cards on the mana-sync container so the
    cards.mana.how Sync loop stops 402-ing.
  • Tests cover the exemption + the empty/whitespace edge cases. All
    other apps keep the original behaviour (fail-open if mana-credits
    is unreachable, 402 if it explicitly says inactive).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

services/mana-sync/cmd/server/main.go

@@ -52,7 +52,9 @@ func main() {
 	hub := ws.NewHub(validator)
 
 	// Initialize billing checker (verifies sync subscription via mana-credits)
-	billingChecker := billing.NewChecker(cfg.ManaCreditsURL, cfg.ServiceKey)
+	// Exempt apps bypass the gate entirely — used for products that promise
+	// free Sync (e.g. Cards).
+	billingChecker := billing.NewChecker(cfg.ManaCreditsURL, cfg.ServiceKey, cfg.BillingExemptApps)
 	billingMiddleware := billingChecker.Middleware(validator)
 
 	// Initialize Space-membership lookup against mana-auth. The handler