fix(kiloclaw): log instance-scoped billing mutations

[jeanduplessis]

Summary

Adds in-transaction audit logging to instance-scoped KiloClaw billing mutations.

Why this change is needed

Legacy personal billing mutations already wrote subscription changelog entries, but newer instance-scoped procedures mutated same subscription fields without writing matching audit records. That left support and reconciliation with incomplete history for cancel, conversion, reactivation, and plan-switch flows when users acted from instance-scoped screens.

How this is addressed

• Added shared router helper that reads subscription state, applies mutation in one transaction, and writes matching user changelog entry with existing action and reason semantics.
• Updated instance-scoped cancel, conversion prepare and rollback and request, reactivate, switch-plan, stale-schedule-clear, and cancel-switch flows to use logged mutations instead of raw updates.
• Added focused router coverage for instance-scoped changelog writes, including stale schedule recovery and conversion rollback paths.

Verification

• pnpm test -- apps/web/src/routers/kiloclaw-billing-router.test.ts
• pnpm typecheck
• pnpm format

Visual Changes

N/A

Reviewer Notes

Human Reviewer

• Stacked on docs(specs): clarify kiloclaw compliance rules #2578.
• Keeps existing action and reason labels from legacy billing endpoints instead of introducing new audit vocabulary.
• Stale-schedule clearing in instance-scoped switch flow now emits its own schedule_changed entry before new schedule creation. Reviewers should confirm that treating this cleanup as first-class audit history matches expected operator semantics.

Code Reviewer Agent

Code Reviewer Notes

• Main change is mutateUserSubscriptionWithChangeLog in apps/web/src/routers/kiloclaw-router.ts, which wraps before read, mutation, and changelog insert in one DB transaction.
• Patch only touches instance-scoped helper path (cancelKiloclawSubscriptionForRow, acceptKiloclawConversionForRow, reactivateKiloclawSubscriptionForRow, switchKiloclawPlanForRow, cancelKiloclawPlanSwitchForRow). Legacy top-level procedures already had changelog coverage and were left functionally unchanged.
• switchKiloclawPlanForRow now takes userId so schedule mutations can log actor context. Conflict handling and Stripe cleanup behavior stay same.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• apps/web/src/routers/kiloclaw-router.ts
• apps/web/src/routers/kiloclaw-billing-router.test.ts

---

_{Reviewed by gpt-5.4-20260305 · 520,113 tokens}