Backend API needed for real account and license sync.

Core endpoints

• POST /api/auth/oauth/start starts OAuth with signed state and PKCE.
• POST /api/auth/oauth/callback creates a secure HttpOnly session.
• POST /api/stripe/create-checkout-session creates Checkout on the server.
• POST /api/stripe/webhook verifies Stripe signatures and creates licenses.
• POST /api/licenses/verify returns plan limits to Chrome.
• POST /api/extension/sync saves profile, usage, questions, pages, Continue clicks, and confirmations.
• POST /api/notifications/subscribe stores iPhone push consent.

Security rules

Keep Stripe keys, OAuth secrets, Gmail tokens, push private keys, and webhook secrets server-side only. The Chrome extension should send signed, minimal snapshots tied to the user license and installation id.