[Phase 0d] PayPal subscription: create-paypal-subscription (~2h)

[TortoiseWolfe]

Part of epic #100.

Function to ship

create-paypal-subscription

• Browser caller: src/lib/payments/paypal.ts:145
• Request body: { plan_id: string, customer_email: string }
• Logic:
  1. CORS + auth
  2. Get PayPal access token
  3. POST /v1/billing/subscriptions with the plan_id (created beforehand in PayPal dashboard) and approval URLs
  4. Write subscriptions row with provider='paypal', status='pending', customer_email
  5. Return { subscription_id: response.id, approval_url: response.links.find(l => l.rel === 'approve').href }
• Browser redirects user to approval_url. The existing paypal-webhook handles BILLING.SUBSCRIPTION.ACTIVATED to flip the DB row's status to active. No changes needed there.

Tests

• Deno unit tests mocking PayPal REST
• Un-skip tests/e2e/payment/02-paypal-subscription.spec.ts:3 (subscription creation test)

Acceptance

• Function exists at supabase/functions/create-paypal-subscription/index.ts
• Deno tests pass
• Deploy succeeds
• Subscribing via SubscriptionManager → PayPal sandbox → returns to /payment-result → subscriptions row activated via webhook

🤖 Created from audit on 2026-05-20