fix: support approved prepaid BAA signing

[richiemcilroy]

What changed

• Allow an already-paid BAA to be signed when support has explicitly waived the Pro prerequisite for that exact BAA record, organization, and owner.
• Require a real BAA subscription with an entitled status and preserve the usual Pro checks for all new purchases and unwaived agreements.
• Preserve the scoped waiver during Stripe reconciliation and Pro cleanup, including separate Stripe customer records; a canceled or unpaid BAA still loses access.
• Reuse the existing paid subscription without another checkout, charge, or change to Pro billing or seats.
• Report BAA email delivery only after the email provider confirms it, and clarify the prepaid signing copy.

Verification

• 101 tests passed across the BAA action, Stripe webhook, and dashboard card suites.
• Web TypeScript check passed.
• Scoped Biome and git diff checks passed.
• Independent review of the production changes found no remaining blockers.

Rollout

Deploy before adding any support waiver metadata. This change does not create waivers, modify customer accounts, sign agreements, or change subscription prices automatically. A waiver must be explicitly set by support on the paid BAA subscription and bound to its persisted record, organization, and user. Live customer signing remains a separate verification step.

Greptile Summary

This PR permits a paid BAA to bypass the normal Pro prerequisite only when an entitled BAA subscription carries an exact record-, organization-, and owner-bound waiver.

• Preserves valid waived BAA subscriptions during Stripe reconciliation and Pro cleanup while still canceling unpaid or invalid subscriptions.
• Reuses an existing paid BAA subscription during signing and records email delivery only after provider confirmation.
• Updates dashboard copy and adds focused action, webhook, waiver-scope, and email-failure tests.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete blocking or independently actionable non-blocking issues identified.

The waiver remains bound to an entitled BAA subscription and exact persisted identities, while payment validation, invalid-status cancellation, ordinary Pro enforcement, and email-delivery confirmation remain enforced.

Important Files Changed

Filename	Overview
apps/web/lib/baa/billing.ts	Adds a tightly scoped waiver predicate and integrates it into the existing Pro-entitlement enforcement helper.
apps/web/actions/organization/signed-baa.ts	Defers the Pro check until the paid BAA can be inspected, permits only a bound waiver, and verifies provider acceptance before recording email delivery.
apps/web/app/api/webhooks/stripe/route.ts	Preserves entitled, correctly bound waived subscriptions during BAA reconciliation and Pro cleanup without exempting ordinary BAAs.
apps/web/app/(org)/dashboard/settings/organization/components/SignedBaaCard.tsx	Updates prepaid-signing copy to avoid claiming that every BAA ends when Pro is canceled.
apps/web/tests/unit/signed-baa.test.ts	Adds coverage for waiver identity, entitlement states, prepaid signing, legacy Pro placeholders, and confirmed email delivery.
apps/web/tests/unit/signed-baa-webhook.test.ts	Adds coverage for waived subscription reconciliation, invalid bindings, Pro cleanup, and alternate Stripe customer records.

_{Reviews (1): Last reviewed commit: "fix: support approved prepaid BAA signin..." | Re-trigger Greptile}

[superagent-security]

🚨 Contributor flagged. Click here for more info: Superagent Dashboard