fix(billing): backfill finite image quota after free-plan rebuild

Expired paid users were rebuilt as free with period_images_limit=0, which the quota system treats as unlimited. Write the catalog quota on rebuild and repair existing finite plans on schema ensure.

Co-authored-by: Cursor <cursoragent@cursor.com>

billing-subscription.mjs

@@ -1000,6 +1000,36 @@ export async function ensurePlanCatalogSchema(pool) {
       [nextTokens, now, planType, previousTokens],
     );
   }
+
+  // Repair active subscriptions that inherited DEFAULT 0 (unlimited) from the
+  // pre-image-quota free-plan backfill, but whose catalog quota is finite.
+  // True unlimited plans (catalog period_images = 0) are left unchanged.
+  await pool.query(
+    `INSERT INTO h5_image_quota_ledger
+       (id, user_id, delta, balance_after, reason, ref_id, operator_id, note, created_at)
+     SELECT UUID(), s.user_id, p.period_images,
+            GREATEST(0, p.period_images + s.period_images_bonus - s.period_images_used),
+            'plan_change', s.id, NULL,
+            '回填套餐默认图片额度（补建漏写）', ?
+     FROM h5_subscriptions s
+     INNER JOIN h5_plan_catalog p ON p.plan_type = s.plan_type
+     WHERE s.status = 'active'
+       AND s.expires_at > ?
+       AND s.period_images_limit = 0
+       AND p.period_images > 0`,
+    [now, now],
+  );
+  await pool.query(
+    `UPDATE h5_subscriptions s
+     INNER JOIN h5_plan_catalog p ON p.plan_type = s.plan_type
+     SET s.period_images_limit = p.period_images,
+         s.updated_at = ?
+     WHERE s.status = 'active'
+       AND s.expires_at > ?
+       AND s.period_images_limit = 0
+       AND p.period_images > 0`,
+    [now, now],
+  );
 }
 
 export function createPlanCatalogService(pool) {