Item 0 — founder count = REAL active Stripe subscriptions (kills the phantom 1)

The counter showed 1/100 from user_profiles (founder_pricing=true AND
subscription_status='active'), but the live Stripe account has ZERO
subscriptions of any status — the "1" is a comped/manually-tiered profile, not a
paying founder. A tier/founder_pricing field on a profile can be set without
ever paying, so it is not proof of a paid seat.

Now the count is Stripe's OWN truth: stripeService.countFounderSeats() counts
ACTIVE subscriptions on a founder price. The route reads that (cached 5 min);
null or any failure → hidden, never a number. A comped profile no longer counts
→ the honest number is 0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/integration/foundersRoute.test.js

@@ -1,7 +1,9 @@
 'use strict';
 
-// Item 2 (Truth-Everywhere Part 2) — the founder-seat counter is REAL or hidden,
-// never a fabricated "47 / 100". Redis mocked; the Supabase client injected.
+// Founder-seat counter — the count is REAL active Stripe subscriptions or hidden,
+// never a fabricated number and never a DB tier/founder_pricing field a comped
+// profile can set without paying (security follow-up item 0). Redis mocked; the
+// Stripe seat-count injected.
 
 const request = require('supertest');
 
@@ -17,60 +19,41 @@ jest.mock('../../src/utils/redis', () => ({
 const app = require('../../src/app');
 const foundersRouter = require('../../src/routes/founders');
 
-// A fake Supabase query builder that resolves to a fixed count/error.
-function fakeClient({ count = 0, error = null } = {}) {
-  const b = {
-    from() { return b; },
-    select() { return b; },
-    eq() { return b; },
-    then(resolve) { return Promise.resolve({ count, error }).then(resolve); },
-  };
-  return b;
-}
-
 beforeEach(() => { mockStore = {}; foundersRouter.__setDeps({}); });
 
 describe('GET /api/founders/count', () => {
-  test('real active-founder count → { available, claimed, total }', async () => {
-    foundersRouter.__setDeps({ getClient: () => fakeClient({ count: 3 }) });
+  test('real active Stripe founder subs → { available, claimed, total }', async () => {
+    foundersRouter.__setDeps({ countSeats: async () => 3 });
     const res = await request(app).get('/api/founders/count');
     expect(res.status).toBe(200);
-    expect(res.body.available).toBe(true);
-    expect(res.body.claimed).toBe(3);
-    expect(res.body.total).toBe(100);
+    expect(res.body).toEqual({ available: true, claimed: 3, total: 100 });
   });
 
-  test('a low real count is shown honestly (no fabricated floor)', async () => {
-    foundersRouter.__setDeps({ getClient: () => fakeClient({ count: 0 }) });
+  test('ZERO real paid subs is shown honestly (a comped profile does not count)', async () => {
+    foundersRouter.__setDeps({ countSeats: async () => 0 });
     const res = await request(app).get('/api/founders/count');
     expect(res.body).toEqual({ available: true, claimed: 0, total: 100 });
   });
 
-  test('query error (column missing) → available:false, NEVER a number', async () => {
-    foundersRouter.__setDeps({ getClient: () => fakeClient({ error: { message: 'no column' } }) });
+  test('Stripe / founder prices unconfigured (null) → available:false, hidden', async () => {
+    foundersRouter.__setDeps({ countSeats: async () => null });
     const res = await request(app).get('/api/founders/count');
     expect(res.body).toEqual({ available: false });
     expect(res.body).not.toHaveProperty('claimed');
   });
 
-  test('unconfigured source (no client) → available:false, hidden', async () => {
-    foundersRouter.__setDeps({ getClient: () => null });
+  test('Stripe throws → available:false, never fabricates', async () => {
+    foundersRouter.__setDeps({ countSeats: async () => { throw new Error('stripe down'); } });
     const res = await request(app).get('/api/founders/count');
     expect(res.body).toEqual({ available: false });
   });
 
-  test('client throws → available:false, never fabricates', async () => {
-    foundersRouter.__setDeps({ getClient: () => { throw new Error('down'); } });
-    const res = await request(app).get('/api/founders/count');
-    expect(res.body).toEqual({ available: false });
-  });
-
-  test('served from cache when warm (no client call)', async () => {
+  test('served from cache when warm (no Stripe call)', async () => {
     mockStore['founders:count'] = { claimed: 7 };
-    let clientCalled = false;
-    foundersRouter.__setDeps({ getClient: () => { clientCalled = true; return fakeClient({ count: 999 }); } });
+    let called = false;
+    foundersRouter.__setDeps({ countSeats: async () => { called = true; return 999; } });
     const res = await request(app).get('/api/founders/count');
     expect(res.body).toEqual({ available: true, claimed: 7, total: 100 });
-    expect(clientCalled).toBe(false);
+    expect(called).toBe(false);
   });
 });