fix(subscriptions): expire trial subs past end_date, not just active

The subscription-expiry cron filtered status="active" only, so trials
never transitioned out of "trial" after end_date. Every access gate
keys off status, so trials past end_date kept full product access for
free (revenue leak) and inflated the active-trial count. On prod: 105
stuck trials, 3528 brand grants still live.

- expiry processor now sweeps status IN (active, trial) past end_date
  (lt() still skips NULL end_date, so perpetual subs are untouched)
- add "trial" to SubscriptionStatus union — it was used in the DB and
  code but missing from the type (both subscription.ts and user.ts)

Proven read-only on prod: old WHERE caught 0, fixed catches 105.
Revocation uses the existing set-expired + delete-userBrands path.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packages/shared/src/types/subscription.ts

@@ -21,7 +21,7 @@ export interface Subscription {
   updatedAt: Date;
 }
 
-export type SubscriptionStatus = "pending" | "active" | "cancelled" | "expired";
+export type SubscriptionStatus = "pending" | "active" | "trial" | "cancelled" | "expired";
 
 export interface UserBrand {
   id: string;

packages/shared/src/types/user.ts

@@ -28,4 +28,4 @@ export interface UserSubscriptionSummary {
   expiresAt: Date;
 }
 
-export type SubscriptionStatus = "pending" | "active" | "cancelled" | "expired";
+export type SubscriptionStatus = "pending" | "active" | "trial" | "cancelled" | "expired";