Phase 3.7: paid pairing flow + returning chat + extension flip

- Backend: payment_sessions + pairing_failures tables; payment.service.js
  and pairing-failure.service.js (new); rewritten pairing.service.js
  (payment-gated blast + targeted "Curhat lagi" + cancel + fallback);
  rewritten extension.service.js (data-driven auto-approve with offline
  safeguard, charge-at-approval); pricing.service.js (extension tiers
  without free trial); mitra-status.service.js (countAvailableMitras
  cached path); 60s sweeper for stale payment sessions
- Backend routes: client.payment.routes, client.mitra-availability.routes,
  internal/failed-pairings.routes; client.chat.routes rewritten for
  payment-gated start + /returning + /cancel + /fallback-to-blast;
  internal/config.routes adds 4 new keys with Valkey invalidate publish
- client_app: mitra-availability poll, payment screen + notifier, pairing
  notifier rewrite (PairingTargetedWaiting + PairingFailed states),
  targeted-waiting overlay + bestie-unavailable dialog, "Curhat lagi"
  CTA, failed-pairing terminal, extension via payment-session
- mitra_app: PairingRequestType enum, returning-chat 20s countdown
  auto-dismiss, extension card "otomatis disetujui" copy
- control_center: 4 new config rows in Settings, Failed Pairings page
  (filter + paginate + action menu), sidebar + route registered
- Test infrastructure: Vitest backend (7/7 pass), Playwright CC (4/4
  pass), Maestro mobile scaffold (CLI install pending)
- Bugs found via Playwright + fixed: LoginPage labels not associated
  with inputs (a11y); backend internal CORS missing PATCH/PUT/DELETE
  in allow-methods (silent settings breakage in browsers since Stage 4)
- Docs: phase3.7.md PRD, phase3.7-plan.md, phase3.7-questions.md (Q&A),
  phase3.7-testing.md (E2E checklist), phase3.7-test-run-2026-05-03.md
  (today's run results)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

client_app/.maestro/scripts/mitra_accept_latest.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Find the most recent pending chat_session for the test mitra and accept it via
+# the backend API. Used by Maestro flows that drive the customer side and need a
+# mitra to "accept" without running a second app.
+#
+# Reads from .maestro/config.yaml env (BACKEND_URL, TEST_MITRA_ID, TEST_MITRA_JWT).
+# Maestro injects these as shell env vars before running this script.
+
+set -euo pipefail
+
+: "${BACKEND_URL:?BACKEND_URL must be set in .maestro/config.yaml}"
+: "${TEST_MITRA_ID:?TEST_MITRA_ID must be set in .maestro/config.yaml}"
+: "${TEST_MITRA_JWT:?TEST_MITRA_JWT must be set in .maestro/config.yaml}"
+
+# Poll for a pending request (blast may take 1-2 seconds to arrive)
+for i in 1 2 3 4 5; do
+  pending=$(curl -fsSL "$BACKEND_URL/api/mitra/chat-requests/pending" \
+    -H "Authorization: Bearer $TEST_MITRA_JWT" 2>/dev/null || echo '{"data":[]}')
+  session_id=$(echo "$pending" | jq -r '.data[0].session_id // empty')
+  if [ -n "$session_id" ]; then
+    break
+  fi
+  sleep 1
+done
+
+if [ -z "${session_id:-}" ]; then
+  echo "ERROR: no pending chat request found for mitra $TEST_MITRA_ID after 5s" >&2
+  exit 1
+fi
+
+echo "Accepting session $session_id as mitra $TEST_MITRA_ID..."
+curl -fsSL -X POST "$BACKEND_URL/api/mitra/chat-requests/$session_id/accept" \
+  -H "Authorization: Bearer $TEST_MITRA_JWT" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+echo "OK"