refactor(db): replace sqlc with handwritten pgx repos

- Finish Paddle-to-Stripe billing migration; drop paddle/stripe libs
- Renumber migrations; add 00012 memberships+manage_token,
  00013 location_type_capacity
- Add tests: admin, auth, bookings customer service
- Remove graphify-out artifacts and stale env files

Authored By: TDvorak <[email protected]>

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/backend/internal/auth/service_test.go

@@ -0,0 +1,69 @@
+package auth
+
+import (
+	"context"
+	"testing"
+
+	"bookra/apps/backend/internal/db"
+)
+
+func TestLocalTokensVerifyWithIssuerAndAudience(t *testing.T) {
+	repo := db.NewMemoryRepository()
+	secret := "test-secret-that-is-long-enough"
+	svc := NewService(repo, secret)
+
+	_, tokens, err := svc.RegisterWithPassword(context.Background(), "[email protected]", "password123", "Test User")
+	if err != nil {
+		t.Fatalf("register: %v", err)
+	}
+
+	verifier, err := NewVerifier("", secret)
+	if err != nil {
+		t.Fatalf("create verifier: %v", err)
+	}
+	defer verifier.Close()
+
+	claims, err := verifier.Verify(tokens.AccessToken)
+	if err != nil {
+		t.Fatalf("verify access token: %v", err)
+	}
+	if iss, _ := claims["iss"].(string); iss != tokenIssuer {
+		t.Fatalf("expected issuer %s, got %v", tokenIssuer, claims["iss"])
+	}
+	if sub, _ := claims["sub"].(string); sub == "" {
+		t.Fatal("expected non-empty sub")
+	}
+}
+
+func TestLocalVerifierRejectsTamperedAndWrongTypeTokens(t *testing.T) {
+	repo := db.NewMemoryRepository()
+	secret := "test-secret-that-is-long-enough"
+	svc := NewService(repo, secret)
+
+	_, tokens, err := svc.RegisterWithPassword(context.Background(), "[email protected]", "password123", "Test User")
+	if err != nil {
+		t.Fatalf("register: %v", err)
+	}
+
+	verifier, err := NewVerifier("", secret)
+	if err != nil {
+		t.Fatalf("create verifier: %v", err)
+	}
+	defer verifier.Close()
+
+	// Refresh tokens carry type=refresh and must not authenticate API calls.
+	if _, err := verifier.Verify(tokens.RefreshToken); err == nil {
+		t.Fatal("expected refresh token to be rejected as access token")
+	}
+
+	// Token signed with a different secret must fail.
+	other := NewService(repo, "different-secret")
+	otherUser, otherTokens, err := other.RegisterWithPassword(context.Background(), "[email protected]", "password123", "Other")
+	if err != nil {
+		t.Fatalf("register other: %v", err)
+	}
+	_ = otherUser
+	if _, err := verifier.Verify(otherTokens.AccessToken); err == nil {
+		t.Fatal("expected token signed with a different secret to be rejected")
+	}
+}