sec(plans): apply the USD-only rule to max_step_commitment once Azure recs carry a currency #1427

What happens

#1296 (for #361) makes the purchase spend cap fail closed: a grant with a USD MaxPurchaseAmount or API-key max_amount is refused any purchase whose commitment currency is not proven to be USD. The plan cap max_step_commitment was deliberately left out. It is still compared against the step's raw amounts, whatever their currency:

• purchase.CheckStepCommitmentCap, used for auto-purchase plan steps;
• requirePlanStepCap (internal/api/handler_purchases.go:1291-1311 on main at 6b586cc), which applies the plan cap to a plan-step row approved through the email link by someone with no approve verb.

So a plan step priced in a non-USD currency can still pass a cap that is meant to bound USD spend. That is the same class of bug #361 describes.

Why it was left out

Every auto-purchase plan must have max_step_commitment (handler_plans.go:642-643). Azure recommendations carry no currency yet (LeanerCloud/cloud-commitments-go#623). Failing closed here today would stop every Azure auto-purchase plan.

Suggested fix

Once LeanerCloud/cloud-commitments-go#623 is released and pinned in go.mod, and Azure recommendations are collected with a currency:

• apply the same rule as enforcePurchaseConstraints in CheckStepCommitmentCap: if any recommendation in the step is not provably USD, refuse the step against the cap, with an error that names the currency and tells the user to refresh recommendations;
• requirePlanStepCap then refuses with a 403, as it does for an over-cap step.

Acceptance criteria

• A plan step whose recommendations are in another currency, or whose currency is empty, is refused by max_step_commitment in both the auto-purchase path and the email-token approve path.
• An all-USD step behaves exactly as before.
• Tests cover a non-USD step, an empty-currency step and a USD step, in both paths.
• Done only after the go bump that sets Azure currency, so Azure auto-purchase plans keep working.

Depends on LeanerCloud/cloud-commitments-go#623. Refs #361, #1296.

Filed by IAmJSD's agent at IAmJSD's request (acting owner while the maintainers are away).