P0/P1: kill mock transcripts, close billing, ship the real pipeline

[Milbaxter]

Makes production honest and chargeable. Live site was serving canned transcripts and minting Pro keys without Stripe.

P0

• Fail closed on /api/transcribe: no canned copy; requires BACKEND_URL
• Real Whisper only (no _local_or_mock_transcribe demo sentences)
• JSON file key store; poly_ prefix is no longer auto-Pro
• Stripe webhook key fulfill; yearly checkout uses annual Price IDs; no ?paid=true mint
• HTTP_PROXY actually passed into youtube-transcript-api and yt-dlp
• Header Omni → Poly, OG image route, fake Libsyn sample replaced, SPONSOR_LINK off polytranscript.dev

P1

• Captions stay sync; Whisper/download returns 202 + job_id with poll
• Spotify DRM rejected; RSS uses the requested episode
• Homepage surfaces summary / chapters / Q&A; YouTube player uses IFrame seekTo
• smithery.json lists all MCP tools; CORS origins fixed

P2 (small)

• Dropped $48k/mo blueprint hero copy
• Search named as keyword overlap, not semantic embeddings
• Removed unused enable_diarization from the API schema

Env you must set (not in this PR)

• Vercel: BACKEND_URL pointing at FastAPI
• STRIPE_WEBHOOK_SECRET + STRIPE_PRICE_*_YEARLY IDs
• HTTP_PROXY / HTTPS_PROXY if scraping YouTube from a datacenter IP
• GROQ_API_KEY or OPENAI_API_KEY (or local faster-whisper)

See .env.example.

Tests

backend/tests/test_honest_pipeline.py — mock fallbacks cannot return demo sentences; unverified requests cannot mint Pro keys.