fix: enforce rollout gates across backend entry points

src/convex/status.ts

@@ -1,6 +1,7 @@
 import { queryGeneric } from "convex/server";
 import { v } from "convex/values";
 import { characterStateValidator } from "./schema";
+import { capabilityEnabled, parseCapabilityAllowlist } from "../lib/server/release-gate";
 
 const safeAssetSyncValidator = v.object({
   status: characterStateValidator,
@@ -24,6 +25,16 @@ function isUsableSession(session: any, timestamp = Date.now()): boolean {
   );
 }
 
+function deploymentCapabilityEnabled(capability: 'subscriptions'): boolean {
+  try {
+    return capabilityEnabled(capability, parseCapabilityAllowlist(process.env.APP_CAPABILITY_ALLOWLIST));
+  } catch {
+    // A malformed backend setting must fail closed, not expose a reactive
+    // tenant projection while the web process reports a configuration error.
+    return false;
+  }
+}
+
 /**
  * Browser-facing character status. Convex validates RS256 issuer/audience
  * through auth.config.ts; the checks here make the application boundary and
@@ -34,6 +45,7 @@ export const characters = queryGeneric({
   args: {},
   returns: v.union(v.null(), v.array(safeCharacterValidator)),
   handler: async (ctx) => {
+    if (!deploymentCapabilityEnabled('subscriptions')) return null;
     const identity = await ctx.auth.getUserIdentity();
     if (!identity) return null;