1.0.0-beta4

Access-control, hardening and compatibility release (roadmap Phase 1, #3616939):
- CRITICAL: role revocation now works from a granted_roles snapshot recorded at
  grant time, never a live plan lookup, so a deleted or renamed plan can no
  longer leave users with paid access indefinitely (#3616929; update 10014
  installs and backfills the field; change record:
  https://www.drupal.org/node/3620566).
- Admin collections, settings forms and Field UI now use the defined
  administer subscriptions / administer subscription plans permissions instead
  of four never-defined strings that locked them to user 1 (#3616930).
- Fresh installs no longer fatal on the subscribe paths when default_connector
  is unset: a single installed connector is inferred as the default, pages
  redirect with a friendly message, and the subscribe-url/portal-url APIs
  return a documented 503 error shape (#3616932). The settings form's
  connector select is required and config/install ships every schema key.
- Drupal 12 compatibility: hooks converted to a #[Hook] attribute class with
  injected services; connector plugins are discovered by PHP attribute with
  the annotation still supported; core_version_requirement fixed to
  ^10 || ^11 (#3603421). The || ^12 flip follows once tested against
  Drupal 12 betas.
- Kernel test suite grown from 27 to 42 tests.