feat(dares): ship the dares loop to mobile

Completes the half-built dares feature: send a dare, respond, report done,
confirm, and get a push notification on every transition.

Backend (apps/api):
- New `dares` domain with couple-shared premium entitlement, a free weekly
  send allowance, and server-enforced actor/state rules on every transition.
- `submitted` status so the recipient reports completion and the sender
  confirms, rather than the sender guessing.
- Notifications ride the existing operations outbox via a trigger on
  `sent_dares`. Push copy is generic; store compliance forbids dare text in a
  preview and a test asserts no payload leaks it.
- Worker expiry sweep now covers `pending` as well as `active`/`submitted`;
  an invitation nobody opened previously stayed open forever.

Fixes two latent defects:
- Deleting any dare that had been sent aborted with a check violation, because
  `dare_id` is ON DELETE SET NULL while `sent_dares_dare_or_custom_check`
  required it. Dare text is now snapshotted at send time, which also keeps a
  couple's history stable across catalogue edits.
- The free send allowance was raceable: concurrent requests all read the same
  count and every one succeeded. The count and insert are now serialized on
  the sender's profile row.

Also ports `content_status` review metadata to the API catalogue, which had no
store-safety gating at all, and mirrors the review decision already enforced on
the legacy catalogue.

Mobile: dares screen (active/send/history), send sheet with duration presets,
home tile badging incoming dares, paywall on both proactive and 402 paths.

Verified: lint, typecheck, 379 unit tests, build, 71 integration tests against
local PostgreSQL.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

apps/mobile/src/__tests__/hooks/useDares.test.ts

@@ -0,0 +1,92 @@
+import { act, renderHook, waitFor } from "@testing-library/react-native";
+import { useDares } from "@/features/dares/hooks/useDares";
+import { ApiError, apiClient } from "@/lib/apiClient";
+import type { SentDare } from "@/features/dares/types";
+
+const incoming: SentDare = {
+    id: "dare-1", couple_id: "couple-1", dare_id: "catalogue-1", text: "A dare", intensity: 2,
+    is_custom: false, sender_id: "partner", recipient_id: "me", direction: "incoming",
+    status: "pending", sender_notes: null, sent_at: "2026-08-28T10:00:00.000Z",
+    accepted_at: null, submitted_at: null, completed_at: null, expires_at: null,
+};
+
+const catalog = {
+    entitlement: { is_premium: false, can_send_custom: false, weekly_send_limit: 3, sends_remaining: 2 },
+    packs: [],
+};
+
+const stats = { sent: 1, received: 1, completed_together: 0, active: 1, completed_by_me: 0, completed_by_partner: 0 };
+
+function mockLoad() {
+    return jest.spyOn(apiClient, "get").mockImplementation(async (path: string) => {
+        if (path.startsWith("/v1/dares?filter=active")) return { dares: [incoming] } as never;
+        if (path.startsWith("/v1/dares?filter=history")) return { dares: [] } as never;
+        if (path === "/v1/dares/packs") return catalog as never;
+        if (path === "/v1/dares/stats") return stats as never;
+        throw new Error(`unexpected path ${path}`);
+    });
+}
+
+describe("useDares", () => {
+    beforeEach(() => jest.restoreAllMocks());
+
+    it("loads the inbox, catalogue and stats together", async () => {
+        mockLoad();
+        const { result } = renderHook(() => useDares());
+        await waitFor(() => expect(result.current.loading).toBe(false));
+
+        expect(result.current.active).toHaveLength(1);
+        expect(result.current.history).toHaveLength(0);
+        expect(result.current.catalog?.entitlement.sends_remaining).toBe(2);
+        expect(result.current.stats?.active).toBe(1);
+        expect(result.current.error).toBeNull();
+    });
+
+    it("posts a response and refreshes", async () => {
+        mockLoad();
+        const postSpy = jest.spyOn(apiClient, "post").mockResolvedValue({ dare: { ...incoming, status: "active" } } as never);
+        const { result } = renderHook(() => useDares());
+        await waitFor(() => expect(result.current.loading).toBe(false));
+
+        await act(async () => {
+            await result.current.respond("dare-1", "accept");
+        });
+        expect(postSpy).toHaveBeenCalledWith("/v1/dares/dare-1/respond", { action: "accept" });
+    });
+
+    it("routes a premium refusal to the paywall rather than the error banner", async () => {
+        mockLoad();
+        jest.spyOn(apiClient, "post").mockRejectedValue(new ApiError("Custom dares require premium", 402));
+        const { result } = renderHook(() => useDares());
+        await waitFor(() => expect(result.current.loading).toBe(false));
+
+        await act(async () => {
+            await result.current.send({ custom_dare_text: "mine" });
+        });
+        expect(result.current.paywallReason).toBe("Custom dares require premium");
+        expect(result.current.error).toBeNull();
+
+        act(() => result.current.clearPaywall());
+        expect(result.current.paywallReason).toBeNull();
+    });
+
+    it("surfaces non-premium failures inline", async () => {
+        mockLoad();
+        jest.spyOn(apiClient, "post").mockRejectedValue(new ApiError("A pending dare cannot change to submitted", 409));
+        const { result } = renderHook(() => useDares());
+        await waitFor(() => expect(result.current.loading).toBe(false));
+
+        await act(async () => {
+            await result.current.submit("dare-1");
+        });
+        expect(result.current.error).toBe("A pending dare cannot change to submitted");
+        expect(result.current.paywallReason).toBeNull();
+    });
+
+    it("reports a load failure without crashing", async () => {
+        jest.spyOn(apiClient, "get").mockRejectedValue(new ApiError("offline", 500));
+        const { result } = renderHook(() => useDares());
+        await waitFor(() => expect(result.current.loading).toBe(false));
+        expect(result.current.error).toBe("offline");
+    });
+});