Plan gate hardening

Audited every paid-plan gate and closed four leaks before they could bite a customer.

• Custom domains no longer serve a changelog when the owner has downgraded to free.
• The plan-features trigger only validates when the gated column actually changes, so existing projects keep working after a downgrade.
• The post-checkout success banner now fires — the redirect was dropping its query param.
• API trigger errors map to a typed 403 instead of a 500.

Migration 004 ships the trigger fix and drops the unused custom_domain_verified column.