feat(api): enforce Full Moon premium server-side (ADR 0018)

[miquelmatoses]

Implements ADR 0018 (Option A): enforce premium on the server-dependent Full Moon value surfaces. Client-side scoring is untouched (privacy-by-design). Check authorizes premium OR is_beta so promo accounts keep access.

Reusable dependency (api/deps.py, mirrors require_admin):

async def require_premium(request, user=Depends(get_current_user)):
    ...
    if not row or not (row["premium"] or row["is_beta"]):
        raise HTTPException(status_code=403, detail="Forbidden")
    return user

Gated: POST /witness/sessions, GET /witness/my-sessions, GET /groups/{id}/report-data (on top of membership).

POST /results — inline, fullMoon branch only (free/anon stay open):

if body.instrument == "fullMoon":
    prow = await conn.fetchrow("SELECT premium, is_beta FROM profiles WHERE id = $1", user_id) if user_id else None
    if not prow or not (prow["premium"] or prow["is_beta"]):
        raise HTTPException(status_code=403, detail="Forbidden")

Left open by design: public witness submit, /witness/my-contributions, /me/results, POST /groups.

No migration (handler logic only). Tests: require_premium unit (403/401/pass), route wiring (gated vs non-targets), /results fullMoon (anon/non-premium 403; premium/beta persist; anon newMoon 200). Backend 185 passed, frontend 248 passed, build clean.

🤖 Generated with Claude Code