Harden paid research delivery and add preserved iOS plans and reviews

[Alexaliao001]

Daily research could treat incomplete market data as usable, paid reports lacked durable delivery, and the iOS journal only saved quick decision tags. This change uses completed trading sessions, makes paid delivery recoverable, and adds a free native iOS workflow that preserves a written plan beside its later process review.

Changes

• Share the 2026–2028 trading calendar across web, iOS and Widget; align stock/benchmark dates, preserve UNKNOWN states, count independent providers and limit/coalesce fetches.
• Freeze report inputs before checkout, generate 90-session JSON/charts and optional CSV/ZIP, and persist orders, signed events, refunds and worker leases in SQLite. Access remains tied to the owning account.
• Recover one subscription Checkout attempt per account, reconcile existing subscriptions and route plan changes through Portal. Refunds expire unfinished credited Checkouts; re-checkout validates the current price and credit. Sandbox testing reproduced an unusable old $20 link after refund, not a successful post-refund discounted charge.
• Add dated watchlist reports with 1/10/50 ticker limits and explicit one-time/recurring pricing, cancellation and independent web/iOS entitlements. Preserve the existing user changes included in this branch.
• Make Plan the first iOS tab. Save reasons, trigger/invalidation conditions and a review date; append one later review without rewriting the original. Preserve same-day entries and older journal records. Recheck scan access against current entitlements, use UNKNOWN / PAUSE consistently, and make onboarding scroll at accessibility text sizes.

Validation

• CI 34025153542: Python and iOS unit jobs SUCCESS at binary source commit 73b6e31. The receipt/listing-check follow-up at 21ecf48 also passed both jobs in CI 34025874247; it does not change the app binary.
• 244 isolated Python tests pass, including six refund/re-checkout regressions; P0 smoke and contract validation pass. Independent read-only review found no remaining reproducible P1/P2 within the reviewed changes.
• Core iOS: 52 tests, four live-provider checks skipped, zero failures. Unpurchased plan → save → review → relaunch passed on iPhone 17 Pro, iPhone 13 Pro Max and iPad Pro 12.9-inch. Maximum accessibility text size and native share preview checked.
• Release app/widget 1.2.0 (9) archived, signed, uploaded and processed VALID; debug launch hooks and StoreKit test files are excluded. Six actual native screenshots uploaded and verified COMPLETE against local checksums.
• StoreKit framework purchase/restore/refund acceptance is BLOCKED by SKInternalErrorDomain Code 3 on this Xcode/runtime, including an untouched Xcode-generated control configuration. It is reported in a separate scheme and is not counted as passing. TestFlight sandbox purchase/cancellation/restart-restore remain outstanding.
• Browser checks at 375/1440 pixels; real Stripe sandbox USD/GBP report purchases, signed webhooks, downloads and cross-account rejection; refunds revoke files, credit and old Checkout URLs. Pro purchase, Portfolio upgrade ($70 proration), Portal period-end cancellation, Test Clock renewal/cancellation, failed renewal and recovery verified. These are test payments, not revenue.
• Web runtime package ba87174 has 62 verified manifest entries; SHA-256 699c684db3c7e0930877e15607995a3cc29c84c874a50bc219b81fc448a50aa8. Staged separately on Nube and passed isolated startup as www-data, matching health commit and expected 200/401 routes. Production has not been switched.

Release status

At 2026-09-06 17:45 Asia/Shanghai, iOS 1.2.0 (9) and the existing QuantRadar Unlock IAP were resubmitted together following the historical 4.3(a) feedback. API and Safari both show WAITING_FOR_REVIEW for submission 07500692-0e8e-4347-b06f-395810c8d5b0. The old build 7 submission was canceled, metadata and all screenshots replaced, and release type set to MANUAL. This is not Apple approval or public availability.

Keep this PR draft while commercial market-data display/download rights and purchase acceptance remain unresolved. APILayer acknowledged licensing inquiry ticket 307916; no license or purchase has been accepted. A dedicated live Stripe Portal is prepared, but production price/environment/webhook changes and web runtime cutover remain unapplied.

Evidence: docs/audit/2026-09-06/ and ios/docs/review-build9/ (including the sanitized submission receipt). Deployment and rollback: docs/CORRECT_OPS.md.