Testing: scoped mutation testing (Stryker.NET --since) on billing/auth/date logic #298

Context: No mutation testing in the API.
Do: Add dotnet-stryker (v4.16.x; .NET 8+). Scope mutate to high-stakes modules: Play-billing verification + RTDN handling, auth/token paths, and domain date/streak/overdue logic. Use --since:main per-PR (native git diff) + --with-baseline; nightly full run. Break threshold on the scoped set. Review survivors manually.
Gate: BLOCK scoped per-PR; nightly = REPORT.
Why: same rubber-stamp-test defense as thomasluizon/orbit-ui-mobile#417; Trail of Bits (Apr 2026): mutation score proves a test is sensitive, not correct.