feat: a source stops pulling once its membership ends, and resumes on resubscribe (3995)

Operator, 2026-09-13: "if I kill a subscription on patreon I would like the pulling to stop on curator as well", with auto-resume chosen. This reverses the 2026-09-11 "report only" decision for lapsed sources.

membership_reconcile.apply_membership_lapses runs in sync_memberships right after each platform's successful sync, so it only ever acts on the roster just written.

It stops a source (enabled=false, with the same failure-state reset as a manual disable, #1285) only when all of these hold:
- the roster is fresh
- the source's matched membership says has_paid_access is False (lapsed, or a free follow)
- the paid-through date has passed, where the platform gives one (Patreon's member.access_expires_at; SubscribeStar gives none, so it stops at once)
- the source is enabled
- the operator hasn't chosen to keep it

It never acts on absence. A source with no matched membership keeps pulling, because a rename or a never-walked source produces the same absence. An unrecognised status is never a lapse either.

It resumes only sources carrying its own `_membership_stopped` marker, once the membership is paid again.

The operator outranks the sweep both ways (SourceService.update):
- turning a stopped source back on marks it `_membership_kept`, so the next sweep leaves it alone until it's paid again
- turning a source off by hand drops the marker, so the sweep never switches it back on

Both are `_`-prefixed app-managed config keys, which operator edits already preserve. No migration.

The roster/fetch line holds. This is a source-level action by the sweep. No download path reads the roster, and the scheduler still selects on `enabled` alone. test_no_fetch_path_can_read_the_roster is unchanged.

UI: SourceRow shows a neutral "Membership ended" chip, with the status and the resume/keep explanation, ahead of the other chips. The sweep's task summary reports stopped/resumed counts.

Tests (tests/test_membership_lapses.py):
- a lapse stops the source with a clean slate and keeps the id cache
- paid-through is honoured
- absence, an unknown status and a stale roster never stop anything
- a resume touches only what the sweep stopped
- a manual on sticks, a manual off drops the marker, and a kept source is released once paid

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SHQB1YukL3VyvMK8rcbmV9

backend/app/services/source_service.py

@@ -19,6 +19,7 @@ from ..models import (
 )
 from .db_helpers import failing_sources_clause
 from .gallery_dl import ErrorType
+from .membership_reconcile import KEPT_KEY, STOPPED_KEY
 from .membership_roster import gated_reasons_for_sources
 from .platforms import known_platform_keys
 from .scheduler_service import compute_next_check_at
@@ -171,6 +172,25 @@ def arm_backfill(source: Source) -> None:
     source.backfill_runs_remaining = BACKFILL_MAX_CHUNKS
 
 
+def _record_manual_enable_choice(source: Source, *, enabled: bool) -> None:
+    """Keep the membership sweep (#3995) from overriding the operator.
+
+    Turning a source the sweep STOPPED back on is a deliberate choice to keep
+    pulling a lapsed creator, so it is marked kept and the next sweep leaves it
+    alone. Turning a source off by hand drops any sweep marker, so the sweep
+    never switches back on something the operator switched off themselves.
+    """
+    co = dict(source.config_overrides or {})
+    if enabled and STOPPED_KEY in co:
+        co.pop(STOPPED_KEY)
+        co[KEPT_KEY] = True
+    elif not enabled:
+        co.pop(STOPPED_KEY, None)
+    else:
+        return
+    source.config_overrides = co
+
+
 class SourceService:
     def __init__(self, session: AsyncSession):
         self.session = session
@@ -428,6 +448,9 @@ class SourceService:
         for key, value in fields.items():
             setattr(source, key, value)
 
+        if "enabled" in fields:
+            _record_manual_enable_choice(source, enabled=bool(fields["enabled"]))
+
         if url_changed:
             # Repointing a source at a different creator makes a cached campaign
             # id WRONG, not merely stale, and `patreon_resolver` consults that