feat(services): create mana-subscriptions, remove from mana-core-auth

Extract subscription billing into standalone mana-subscriptions service
(Hono + Bun, Port 3063). Also removes Stripe module from mana-core-auth
since subscription webhooks are the last consumer.

New service (services/mana-subscriptions/):
- Plans CRUD, subscription management, Stripe Checkout + Portal
- Invoice tracking, webhook handlers for sub/invoice events
- Internal API for plan limits (consumed by guilds service)
- ~990 LOC (vs ~1,700 in NestJS incl. Stripe module)

Removed from mana-core-auth:
- subscriptions/ module (6 files)
- stripe/ module (4 files) — no longer needed in auth
- db/schema/subscriptions.schema.ts
- guilds.service.ts: replaced direct DB plan limit query with
  HTTP call to mana-subscriptions internal API

mana-core-auth now contains only:
- Auth (Better Auth, JWT, Sessions, 2FA, Passkeys, OIDC)
- Organizations/Guilds (membership only, no credits/plans)
- API Keys, Security, Me (GDPR), Health, Metrics
- Feedback + Analytics (next extraction target)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docker-compose.macmini.yml

@@ -325,8 +325,8 @@ services:
     container_name: mana-core-searxng
     restart: always
     volumes:
-      - ./services/mana-search/searxng/settings.yml:/etc/searxng/settings.yml:ro
-      - ./services/mana-search/searxng/limiter.toml:/etc/searxng/limiter.toml:ro
+      - ./services/mana-search-go/searxng/settings.yml:/etc/searxng/settings.yml:ro
+      - ./services/mana-search-go/searxng/limiter.toml:/etc/searxng/limiter.toml:ro
     environment:
       SEARXNG_BASE_URL: http://searxng:8080
       SEARXNG_SECRET: ${SEARXNG_SECRET:-change-me-searxng-secret}