billing: Nebenläufigkeit & Idempotenz härten (H4, Stripe, Boost-Slots)

- CreditTopup-Gutschrift, MAN-Rechnung, Proof-PDF und Stripe-Webhook-
  Spiegelung sperren die betroffene Zeile innerhalb der Transaktion und
  prüfen die Idempotenz erst danach (verhindert Doppelgutschrift bei
  at-least-once-Webhooks, H4).
- Gemeinsamer LocksModelForUpdate-Trait für die häufige Lock-by-Key-Form
  (CreditTopup, ManualInvoice).
- Unique-Index auf invoices.stripe_invoice_id; Boost-Inventar über
  boost_slot_locks serialisiert, verwaiste Kategorie-Locks werden beim
  Löschen der Rubrik entfernt.

Deployment: vor migrate prüfen, ob invoices.stripe_invoice_id bereits
Duplikate enthält (die Unique-Migration bricht sonst bewusst ab).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/Feature/Billing/DepublicationTest.php

@@ -227,7 +227,7 @@ test('the paid webhook depublishes the release and the public page shows a tombs
     // „Eingelöste Käufe" auf der Buchungs-Seite.
     expect($purchase->fresh()->status)->toBe(SinglePurchaseStatus::Consumed);
     expect($purchase->fresh()->consumed_at)->not->toBeNull();
-    expect($release->statusLogs()->count())->toBeGreaterThan(0);
+    expect($release->statusLogs()->where('source', 'depublication')->count())->toBe(1);
 
     // Der Käufer erhält genau eine Bestätigung (Replay löst keine zweite aus).
     Mail::assertQueued(PressReleaseDepublished::class, function (PressReleaseDepublished $mail) use ($user, $release) {

tests/Feature/Billing/ManualInvoiceGenerationTest.php

@@ -156,6 +156,22 @@ test('agreements with a future period end are not due', function () {
     expect(app(ManualInvoiceService::class)->duePaymentOptions())->toHaveCount(0);
 });
 
+test('a stale due agreement instance cannot be invoiced twice', function () {
+    Carbon::setTestNow('2026-06-12 08:00:00');
+    $agreement = manualAgreement(['current_period_end' => '2026-06-11']);
+    $service = app(ManualInvoiceService::class);
+
+    $firstInvoice = $service->invoiceFor($agreement);
+    $replayedInvoice = $service->invoiceFor($agreement);
+
+    expect($firstInvoice)->not->toBeNull();
+    expect($replayedInvoice)->toBeNull();
+    expect(Invoice::count())->toBe(1);
+    expect($agreement->fresh()->current_period_end->toDateString())->toBe('2026-07-11');
+
+    Carbon::setTestNow();
+});
+
 test('the command invoices all due agreements', function () {
     manualAgreement();
     manualAgreement();

tests/Feature/Billing/StripeWebhookProcessingTest.php

@@ -7,6 +7,7 @@ use App\Models\BillingAddress;
 use App\Models\Invoice;
 use App\Models\SinglePurchase;
 use App\Models\User;
+use Illuminate\Database\QueryException;
 use Illuminate\Support\Facades\Event;
 use Laravel\Cashier\Events\WebhookReceived;
 
@@ -81,6 +82,17 @@ test('duplicate webhook deliveries do not create a second invoice', function ()
     expect(Invoice::count())->toBe(1);
 });
 
+test('stripe invoice ids are unique in the database while null remains repeatable', function () {
+    Invoice::factory()->create(['stripe_invoice_id' => 'in_database_unique']);
+
+    expect(fn () => Invoice::factory()->create(['stripe_invoice_id' => 'in_database_unique']))
+        ->toThrow(QueryException::class);
+
+    Invoice::factory()->count(2)->create(['stripe_invoice_id' => null]);
+
+    expect(Invoice::query()->whereNull('stripe_invoice_id')->count())->toBe(2);
+});
+
 test('the snapshot falls back to the local billing address including vat id', function () {
     $user = User::factory()->create(['stripe_id' => 'cus_test_1']);
     BillingAddress::factory()->create([