feat: a source stops pulling once its membership ends, and resumes on resubscribe (3995)

Operator, 2026-09-13: "if I kill a subscription on patreon I would like the pulling to stop on curator as well", with auto-resume chosen. This reverses the 2026-09-11 "report only" decision for lapsed sources.

membership_reconcile.apply_membership_lapses runs in sync_memberships right after each platform's successful sync, so it only ever acts on the roster just written.

It stops a source (enabled=false, with the same failure-state reset as a manual disable, #1285) only when all of these hold:
- the roster is fresh
- the source's matched membership says has_paid_access is False (lapsed, or a free follow)
- the paid-through date has passed, where the platform gives one (Patreon's member.access_expires_at; SubscribeStar gives none, so it stops at once)
- the source is enabled
- the operator hasn't chosen to keep it

It never acts on absence. A source with no matched membership keeps pulling, because a rename or a never-walked source produces the same absence. An unrecognised status is never a lapse either.

It resumes only sources carrying its own `_membership_stopped` marker, once the membership is paid again.

The operator outranks the sweep both ways (SourceService.update):
- turning a stopped source back on marks it `_membership_kept`, so the next sweep leaves it alone until it's paid again
- turning a source off by hand drops the marker, so the sweep never switches it back on

Both are `_`-prefixed app-managed config keys, which operator edits already preserve. No migration.

The roster/fetch line holds. This is a source-level action by the sweep. No download path reads the roster, and the scheduler still selects on `enabled` alone. test_no_fetch_path_can_read_the_roster is unchanged.

UI: SourceRow shows a neutral "Membership ended" chip, with the status and the resume/keep explanation, ahead of the other chips. The sweep's task summary reports stopped/resumed counts.

Tests (tests/test_membership_lapses.py):
- a lapse stops the source with a clean slate and keeps the id cache
- paid-through is honoured
- absence, an unknown status and a stale roster never stop anything
- a resume touches only what the sweep stopped
- a manual on sticks, a manual off drops the marker, and a kept source is released once paid

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SHQB1YukL3VyvMK8rcbmV9

backend/app/tasks/maintenance.py

@@ -1247,6 +1247,7 @@ def sync_memberships() -> str:
     from ..services.artist_membership_service import rescan as membership_rescan
     from ..services.credential_crypto import CredentialCrypto
     from ..services.credential_service import CredentialService
+    from ..services.membership_reconcile import apply_membership_lapses
     from ..services.membership_roster import roster_user_id, sync_platform
     from ..services.patreon_client import PatreonClient
     from ..services.subscribestar_client import SubscribeStarClient
@@ -1298,9 +1299,18 @@ def sync_memberships() -> str:
                     )
 
                 async with async_factory() as session:
-                    results.append(
-                        await sync_platform(session, platform=platform, fetch=fetch)
-                    )
+                    result = await sync_platform(session, platform=platform, fetch=fetch)
+                results.append(result)
+
+                # #3995: stop pulling sources whose paid access has ended, and
+                # resume the ones this stopped once they are paid again. Only
+                # right after a successful sync, so it always acts on the roster
+                # just written, never on a stale one.
+                if result.get("ok"):
+                    async with async_factory() as session:
+                        result["lapses"] = await apply_membership_lapses(
+                            session, platform=platform,
+                        )
 
             # #388 E4: offer the freshly-synced roster to the artists FC already
             # tracks. Chained here rather than given its own beat entry because
@@ -1321,7 +1331,12 @@ def sync_memberships() -> str:
         if "skipped" in r:
             parts.append(f"{r['platform']}=skipped({r['skipped']})")
         elif r.get("ok"):
-            parts.append(f"{r['platform']}={r['count']}")
+            lapses = r.get("lapses") or {}
+            detail = (
+                f"(stopped={lapses['stopped']},resumed={lapses['resumed']})"
+                if lapses.get("stopped") or lapses.get("resumed") else ""
+            )
+            parts.append(f"{r['platform']}={r['count']}{detail}")
         else:
             parts.append(f"{r['platform']}=FAILED({r['error']})")
     if res.get("suggested") is not None: