billing: add tenant billing contact fields and per-tenant controller

[jshearer]

Summary

Customers cannot self-serve billing email changes today. Every request requires manual Stripe intervention. This adds admin-editable billing contact fields on tenants, a GraphQL mutation for managing them, and a per-tenant controller that reconciles the Stripe-backed subset to Stripe asynchronously.

• Adds billing_email, billing_name, and billing_address fields to tenants, letting admins self-serve billing contact changes through a new setBillingContact GraphQL mutation instead of requesting manual Stripe edits
• Introduces a per-tenant TenantController automation (the first tenant-scoped automation) that reconciles DB-authoritative billing contact data to Stripe asynchronously
• Updates existing customer-creation paths (createBillingSetupIntent, billing-integrations) to prefer tenant-managed billing email over JWT claims when creating new Stripe customers

How it works

The mutation writes Postgres and returns. A trigger wakes the tenant's controller task, which reads current DB state, compares against the Stripe customer, and calls update_customer_billing_profile if they differ. Tenants without a Stripe customer store billing data in the DB; the controller treats "no customer" as a no-op, and customer-creation paths wake the controller afterward.

The controller follows the same sub-controller composition pattern as LiveSpecControllerExecutor: TenantControllerState contains a nested BillingContactStatus managed by the billing_contact sub-module, so future tenant automations can be added as additional sub-controllers.

Migration

20260429120000_tenant_controller_billing_contact.sql:

• Adds columns. New tenants get a controller task via an insert trigger. Existing tenants get one lazily: wake_tenant_controller creates the task on-demand if controller_task_id is null, so setBillingContact or customer-creation paths work without a pre-existing task row.
• Any source of change to these billing fields will trigger the automation to sync to stripe
• Backfills billing_email and billing_address from CDC-synced stripe.customers so existing data matches Stripe without triggering reconciliation. Only tenants that received billing data from this backfill get a controller task row; the rest get one on first use.

Testing

I tested this e2e in a local stack with a testmode Stripe API key