Paying vibe SaaS with open RLS and dead email verify

authRLSStripeLovable

Tried: Vibe-coded SaaS with paying users
Broke: JWT still valid after cancel; is_paid writable from browser; email_verified never flipped
Fix: "Must mutate something or fail loud" per external event