Item 0 — founder count = REAL active Stripe subscriptions (kills the phantom 1)

The counter showed 1/100 from user_profiles (founder_pricing=true AND
subscription_status='active'), but the live Stripe account has ZERO
subscriptions of any status — the "1" is a comped/manually-tiered profile, not a
paying founder. A tier/founder_pricing field on a profile can be set without
ever paying, so it is not proof of a paid seat.

Now the count is Stripe's OWN truth: stripeService.countFounderSeats() counts
ACTIVE subscriptions on a founder price. The route reads that (cached 5 min);
null or any failure → hidden, never a number. A comped profile no longer counts
→ the honest number is 0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/services/stripeService.js

@@ -284,6 +284,28 @@ function constructWebhookEvent(body, signature) {
   return getStripe().webhooks.constructEvent(body, signature, process.env.STRIPE_WEBHOOK_SECRET);
 }
 
+// Security follow-up item 0 — the REAL founder-seat count is the number of
+// ACTIVE Stripe subscriptions on a founder price. It counts Stripe's OWN truth
+// (subscription status on the live account), NOT a tier/founder_pricing field on
+// a DB profile — a comped or manually-tiered account can set those without ever
+// paying, which is exactly the phantom "1" the ClaimMeter was showing. Returns
+// null when Stripe or the founder prices aren't configured → the counter hides.
+async function countFounderSeats() {
+  const founderPrices = [PRICE_MAP.analyst_founder, PRICE_MAP.desk_founder].filter(Boolean);
+  if (!process.env.STRIPE_SECRET_KEY || founderPrices.length === 0) return null;
+  const stripe = getStripe();
+  let count = 0;
+  for (const price of founderPrices) {
+    // Only 'active' (paid + current) subscriptions are a claimed paid seat —
+    // trialing / past_due / canceled are not. Auto-pages the full list.
+    // eslint-disable-next-line no-await-in-loop
+    for await (const _sub of stripe.subscriptions.list({ price, status: 'active', limit: 100 })) {
+      count += 1;
+    }
+  }
+  return count;
+}
+
 module.exports = {
   createCheckoutSession,
   handleWebhookEvent,
@@ -292,6 +314,7 @@ module.exports = {
   constructWebhookEvent,
   isFounderCodeValid,
   getPriceId,
+  countFounderSeats,
   // Session 14 — exposed so the route layer + tests can recognize
   // the "tier valid but Stripe price not provisioned" state.
   PRICE_UNCONFIGURED,