feat: PatreonClient.iter_memberships — the roster seam (milestone 387 step C2)

Built on C0's real capture (Scribe note #3886), not on API docs — gallery-dl
has no membership extractor and Patreon's public v2 API is the CREATOR surface
behind OAuth, so the rule-130 reference had to be a characterized response.

**The request is deliberately minimal, and that is a privacy decision.** The
browser's own include set pulls `latest_pledge.card`, and those card resources
come back carrying the ACCOUNT HOLDER'S EMAIL in `merchant_name`; `address` is
in there too. Copying the query string wholesale is the obvious move and would
have FC fetching payment PII it has no use for and can only mishandle. We ask
for `include=campaign,reward` and nothing else, and a test asserts on the
params actually sent so nobody widens it back.

**We do not send `filter[membership_type]`.** The browser sends the six buckets
its settings page displays, which excludes lapsed memberships — and a
DISAPPEARANCE is precisely the signal the roster exists to read. Filtering here
would manufacture the event C4 acts on.

Two corrections the capture forced, both now in code:

* **The filter vocabulary is not the status vocabulary.** I had read the six
  filter words off a screenshot and was about to write them into
  MEMBERSHIP_STATUS as the enum. The body shows `patron_status` carrying
  `former_patron` — absent from that filter — on a row the filter selected as
  `free_member`. So the map is taught exactly the two OBSERVED values, and
  `declined_patron` stays out despite looking obviously right: believing the
  filter is the mistake that was just caught.
* **Free membership is a boolean, not a status.** `has_paid_access` gains an
  `is_free_member` axis, because `active_patron` alone would report a free
  follower as a paying patron and C4 would never offer to clean it up. Honest
  limit, stated in the docstring: the capture has no ACTIVE free member, so it
  shows the separation is possible, not that it occurs.

C1's tripwire test did its job — it was written to fail the moment anyone
populated the status map, and updating it here IS the confirmation step, done
with the capture rather than ahead of it.

`_fetch`'s retry/backoff/auth-vs-drift/Retry-After logic is extracted to a
shared `_request` so the roster rides the same path rather than growing a
second copy — two copies would drift, and the half that drifted would be the
one that only runs daily. Every error message and log line renders
byte-identically for the posts path, so the existing tests pin the refactor.

Pagination is driven by `page[offset]` against `meta.pagination.total`, never
by `links`: the response's own `links.first` is built WITHOUT the `/api/`
prefix the request uses, so following it would hit the web page. An empty page
is terminal regardless of what the total claims, so a server reporting more
rows than it hands over cannot spin the walk forever.

Drift is stricter here than on the posts path, on purpose: a missing
`meta.pagination.total` raises rather than returning a short list, because a
truncated roster reads downstream as "you cancelled those" — the worst wrong
answer this feature can give.

`current_user_id()` is marked INFERRED, not characterized: C0 captured
/api/members, not /api/current_user, so it relies only on the JSON:API envelope
this API demonstrably uses elsewhere, and raises drift rather than returning
something plausible if that is wrong.

The fixture is derived from the real capture with every piece of account data
replaced (the raw capture stays gitignored). Six members, each earning its
place: a former patron with a null pledge, an active patron with no tier, an
annual cadence, a previous_pledge whose included resource has no
`relationships` key at all, and a reward priced in CAD beside a USD charge —
the trap that makes reading `reward.amount_cents` report a number the operator
was never charged. A leak check caught a free-membership-subscription id and
six real campaign launch timestamps before any of it was staged.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LNXXULQDjVZmbuNa2G9mD9

tests/test_membership_roster.py

@@ -153,15 +153,46 @@ def test_unknown_platform_is_unknown():
     assert has_paid_access("a-platform-with-no-mapping", "active") is None
 
 
-def test_the_status_map_starts_empty_and_that_is_deliberate():
+def test_the_status_map_contains_only_characterised_values():
     """Guards project rule 130 at the one place it is easiest to break.
 
-    Every entry must come from a characterised response (step C0), never from
-    API docs or a plausible-looking guess. If this assertion fails, either C0
-    happened — in which case update this test along with the map, citing the
-    capture — or somebody guessed, which is the thing the rule exists to stop.
+    Every entry must come from a characterised response, never from API docs or
+    a plausible-looking guess. This started life asserting the map was EMPTY;
+    C0 then captured Patreon's real `/api/members` response (Scribe note #3886)
+    and this assertion is the confirmation step — updated with the capture, not
+    ahead of it.
+
+    `declined_patron` is absent ON PURPOSE and must stay absent until a capture
+    shows it in `patron_status`. It appears in the request's
+    `filter[membership_type]`, and the capture proved that filter is a
+    different vocabulary from the attribute: a row the filter selected as
+    `free_member` came back as `former_patron`, a word the filter does not
+    contain. Adding it because it "obviously" belongs is precisely the guess
+    this test exists to stop.
     """
-    assert MEMBERSHIP_STATUS == {}
+    assert MEMBERSHIP_STATUS == {
+        "patreon": {"active_patron": True, "former_patron": False},
+    }
+
+
+def test_a_free_member_does_not_count_as_paid_access():
+    """The second axis. Patreon expresses a free follow as a boolean beside
+    `patron_status`, so a CURRENT membership can still be one nobody pays for —
+    and reporting that as paid access would hide it from C4 forever."""
+    assert has_paid_access("patreon", "active_patron") is True
+    assert has_paid_access("patreon", "active_patron", is_free_member=True) is False
+
+
+def test_the_free_flag_cannot_rescue_a_lapsed_membership():
+    """False from the status is terminal: not-free does not mean still-paying."""
+    assert has_paid_access("patreon", "former_patron") is False
+    assert has_paid_access("patreon", "former_patron", is_free_member=False) is False
+
+
+def test_an_unknown_status_stays_unknown_whatever_the_free_flag_says():
+    """The free flag refines a KNOWN answer; it never manufactures one."""
+    assert has_paid_access("patreon", "declined_patron") is None
+    assert has_paid_access("patreon", "declined_patron", is_free_member=True) is None
 
 
 def test_the_map_is_consulted_once_it_has_entries(monkeypatch):