feat(cost-guard): global Gemini daily budget + EOC alarm; trial requires verified email

apps/api/src/routes/auth.ts

@@ -64,12 +64,6 @@ export async function authRoutes(app: FastifyInstance) {
       updatedAt: consentNow,
     });
 
-    // 7 dagars trial utan kort startar direkt (spec §46)
-    const now = new Date();
-    await app.db
-      .insert(schema.trials)
-      .values({ userId: user.id, startedAt: now, endsAt: trialEndsAt(now) });
-
     await audit(app.db, {
       actorUserId: user.id,
       action: "auth.register",
@@ -235,6 +229,20 @@ export async function authRoutes(app: FastifyInstance) {
       .update(schema.users)
       .set({ emailVerifiedAt: new Date(), updatedAt: new Date() })
       .where(eq(schema.users.id, stored.userId));
+
+    // Trial startas först när e-posten är verifierad. En trial per verifierad e-post.
+    const [existingTrial] = await app.db
+      .select({ id: schema.trials.id })
+      .from(schema.trials)
+      .where(eq(schema.trials.userId, stored.userId))
+      .limit(1);
+    if (!existingTrial) {
+      const now = new Date();
+      await app.db
+        .insert(schema.trials)
+        .values({ userId: stored.userId, startedAt: now, endsAt: trialEndsAt(now) });
+    }
+
     await audit(app.db, { actorUserId: stored.userId, action: "auth.email_verified", ip: req.ip });
     return reply.send({ ok: true });
   });