feat: add MercadoPago payments, subscription service, and webhooks

- MercadoPago PreApproval integration for recurring subscriptions
- Subscription service with caching, manual payment, payment history
- Webhook handler with HMAC-SHA256 signature verification
- Admin endpoints for subscription management and payment links
- Email notifications on payment success/failure/cancellation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/api/src/controllers/subscription.controller.ts

@@ -0,0 +1,51 @@
+import type { Request, Response, NextFunction } from 'express';
+import * as subscriptionService from '../services/payment/subscription.service.js';
+
+export async function getSubscription(req: Request, res: Response, next: NextFunction) {
+  try {
+    const tenantId = String(req.params.tenantId);
+    const subscription = await subscriptionService.getActiveSubscription(tenantId);
+    if (!subscription) {
+      return res.status(404).json({ message: 'No se encontró suscripción' });
+    }
+    res.json(subscription);
+  } catch (error) {
+    next(error);
+  }
+}
+
+export async function generatePaymentLink(req: Request, res: Response, next: NextFunction) {
+  try {
+    const tenantId = String(req.params.tenantId);
+    const result = await subscriptionService.generatePaymentLink(tenantId);
+    res.json(result);
+  } catch (error) {
+    next(error);
+  }
+}
+
+export async function markAsPaid(req: Request, res: Response, next: NextFunction) {
+  try {
+    const tenantId = String(req.params.tenantId);
+    const { amount } = req.body;
+
+    if (!amount || amount <= 0) {
+      return res.status(400).json({ message: 'Monto inválido' });
+    }
+
+    const payment = await subscriptionService.markAsPaidManually(tenantId, amount);
+    res.json(payment);
+  } catch (error) {
+    next(error);
+  }
+}
+
+export async function getPayments(req: Request, res: Response, next: NextFunction) {
+  try {
+    const tenantId = String(req.params.tenantId);
+    const payments = await subscriptionService.getPaymentHistory(tenantId);
+    res.json(payments);
+  } catch (error) {
+    next(error);
+  }
+}