feat(healthcare): OIG/SAM exclusion screening as $79/mo Stripe Subscription

Convert OIG/SAM from one-time $299/yr to recurring $79/month (card+ACH only) -
the first real recurring-billing product in the system. Exclusion screening is
a *monthly* federal obligation, so recurring monitoring fits the requirement and
is the biggest valuation lever (vs a one-time annual run).

Catalog (single source of truth):
- service-catalog.ts: add billing_interval + allowed_methods to ComplianceService;
  oig-sam-screening -> 7900c, billing_interval:"month", allowed_methods:[card,ach],
  name "(Monthly Monitoring)".
- gen-service-catalog.py + check-service-catalog-drift.py: carry/guard the two new
  fields; regenerate site catalog.

Checkout (api/src/routes/checkout.ts):
- mode:"subscription" with recurring price_data when billing_interval is set;
  surcharge absorbed for recurring (clean $79/mo); server-side METHOD_NOT_ALLOWED
  re-validation against allowed_methods.
- ensureColumns + migration 100: compliance_orders.stripe_subscription_id,
  bundle_upsell_sent_at (+ subscription index).

Webhooks (api/src/routes/webhooks.ts):
- record stripe_subscription_id on checkout.session.completed (subscription mode).
- invoice.paid (subscription_cycle only) -> re-dispatch screening for the cycle;
  invoice.payment_failed -> admin alert + first-failure customer nudge;
  customer.subscription.deleted -> mark order cancelled. (API 2026-03-25 moved the
  subscription link to invoice.parent.subscription_details.subscription.)

Fulfillment:
- job_server.py: pass recurring_cycle/invoice_id into the order.
- npi_provider.py: OIG handler labels renewal cycles "[Monthly cycle]" + re-screen
  note; bundle action runs only the FIRST screening + flags the $79/mo upsell.

Bundle land-and-expand:
- Provider Compliance Bundle now includes only the first OIG/SAM screening (was
  giving away $948/yr of monitoring inside an $899 bundle).
- new worker scripts/workers/bundle_upsell.py (+ pw-bundle-upsell timer): ~3 weeks
  after a paid bundle, emails the customer to continue $79/mo monitoring; dedup via
  bundle_upsell_sent_at; skips customers who already have an OIG/SAM order.

Surfaces updated to $79/mo: PaymentStep (filters methods, "Billed every month,
cancel anytime"), order pages, healthcare index, npi-compliance-check tool (also
fixed stale $699 bundle drift -> $899), hc_oig_screening + hc_compliance_bundle
emails.

Docs: billing.md gains a "Stripe-native Subscriptions" section + a reality-check
banner (Adyen/ERPNext-gateway model documented there is NOT live; Stripe is the
real rail). Fixed run-migrations.yml container name bug
(performancewest-postgres-1 -> performancewest-api-postgres-1, overridable).

Tests: api/tests/recurring-subscription.test.ts (28 assertions) covers catalog
gating, method validation, surcharge suppression, recurring line-item build,
invoiceSubscriptionId extraction, renewal-cycle gating. tsc clean; site build
clean; catalog drift OK.

Manual deploy step: enable invoice.paid, invoice.payment_failed,
customer.subscription.deleted on the Stripe webhook endpoint.

api/src/service-catalog.ts

@@ -20,6 +20,20 @@ export interface ComplianceService {
   gov_fee_label?: string;
   erpnext_item: string;
   discountable: boolean;
+  /**
+   * Recurring billing. When set, checkout builds a Stripe Subscription
+   * (mode:"subscription") that charges price_cents every interval instead of a
+   * one-time payment. Only payment methods that support off-session recurring
+   * charges are allowed for these (see allowed_methods).
+   */
+  billing_interval?: "month" | "year";
+  /**
+   * Restrict the payment methods offered for this service. Omit = all methods
+   * (card, ach, paypal, klarna, crypto). Recurring services MUST list only
+   * methods that can do off-session charges: ["card","ach"] — PayPal/Klarna/
+   * crypto here are one-time only and cannot back a subscription.
+   */
+  allowed_methods?: ("card" | "ach" | "paypal" | "klarna" | "crypto")[];
 }
 
 export const COMPLIANCE_SERVICES: Record<string, ComplianceService> = {
@@ -535,10 +549,16 @@ export const COMPLIANCE_SERVICES: Record<string, ComplianceService> = {
     discountable: true,
   },
   "oig-sam-screening": {
-    name: "OIG/SAM Exclusion Screening (Annual)",
-    price_cents: 29900,
+    name: "OIG/SAM Exclusion Screening (Monthly Monitoring)",
+    price_cents: 7900,
     erpnext_item: "OIG-SAM-SCREENING",
     discountable: false,
+    // Federal exclusion screening is a MONTHLY obligation (OIG SAB) — sell it as
+    // recurring monitoring, not a one-time annual run. Recurring requires an
+    // off-session-capable rail, so only card + ACH (PayPal/Klarna/crypto can't
+    // back a subscription).
+    billing_interval: "month",
+    allowed_methods: ["card", "ach"],
   },
   "provider-compliance-bundle": {
     name: "Provider Compliance Bundle (Annual)",