fix: remove custom domains after plan expiry

[Innei]

Summary

• delete every Cloudflare Custom Hostname and local tenant-domain record after a paid plan is revoked
• propagate cleanup failures so Creem can retry the expiration webhook
• treat Cloudflare 404 responses as successful idempotent deletions
• add regression coverage for the expiration hook, cleanup ordering, retry safety, and idempotent provider deletion

Why

Tenants lost custom-domain routing when their Pro entitlement expired, but the Cloudflare hostname and local domain record remained allocated. This leaked provider-side resources and retained stale bindings.

Validation

• pnpm exec vitest run — 22 files, 79 tests passed
• targeted ESLint — passed
• pnpm run build for @afilmory/core — passed
• standalone tsc --noEmit is currently blocked by the repository resolving TypeScript 5.9.3 while ignoreDeprecations is configured for 6.0

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
afilmory-demo	Ready	Preview	Aug 7, 2026 4:10pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
afilmory-docs	Skipped		Aug 7, 2026 4:10pm

[safedep]

SafeDep Report Summary

No dependency changes detected. Nothing to scan.

View complete scan results →

_{This report is generated by SafeDep Github App}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cca58ebe94

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Verify the revocation is still current before deleting domains

When an expiration/cancellation webhook from an older subscription is delayed or retried after the tenant has purchased or reactivated a paid plan, this path still deletes every domain currently owned by the tenant because it validates neither the subscription identity nor the tenant's latest entitlement. Previously such an out-of-order event could temporarily set the plan to free, but a subsequent active webhook restored access to the retained binding; this change irreversibly removes the newly valid Cloudflare hostname and local record. Gate destructive cleanup on the revocation still representing the tenant's current subscription state.

Useful? React with 👍 / 👎.