Fix sticky B2C paywall loop by using Clerk subscription state

[codybmenefee]

Root cause

The app gate relied on useAuth().has({ plan }) session claims, but prod sessions with an active org only exposed pla: "o:free_org" for this user. That made all B2C checks fail (early_access false) even when the user had a user subscription.

There was also a scope format mismatch in our helper: it expanded to u:/o: while Clerk expects user:/org: in has() checks.

Fix

• Correct scope expansion/normalization to include user:/org: (plus short-form back-compat).
• Add useResolvedBillingAccess hook that resolves access from Clerk Billing subscription (clerk.billing.getSubscription({})) using active user subscription items.
• Keep session-based checks as fallback only.
• Wire both /app and /subscribe to this shared resolved billing source so gating is consistent.

Validation

• cd app && npx eslint src/lib/auth/billing.ts src/lib/auth/useResolvedBillingAccess.ts src/routes/app.tsx src/routes/subscribe.tsx
• cd app && pnpm run build