1.0.0-beta5

Multi-connector correctness release (roadmap Phase 2, #3616939): the
structural work that makes several connectors running side by side safe.

- One active subscription per user, site-wide, enforced at save time: the
  newest activation deactivates any other active subscription, revoking its
  snapshotted roles (#3616778; see the change record). Local subscription
  selection is now deterministic — active first, then newest — instead of
  storage order, and the "has a subscription" checks gained an active_only
  parameter, which the post-login subscribe redirect now uses so lapsed
  subscribers are redirected again.
- The self-healing remote sync consults every installed connector (default
  first) instead of only default_connector, stopping at the first that
  yields; one provider's outage no longer blocks reconciliation against the
  others (#3616770; see the change record).
- The remote-sync reconciliation moved into
  SubscriptionManagerService::syncRemoteSubscriptions(), and the hand-rolled
  cron drain became a QueueWorker plugin with core's per-item retry
  handling, fixing the poison-item stall that let one failing queue item
  block the whole queue (#3616880).
- Plan lookups are scoped by the subscription's connector, so two connectors
  sharing a remote plan_id can no longer grant each other's roles or link
  the wrong plan (#3616776).
- The post-login subscribe redirect polls every installed connector and
  redirects only on unanimity: any connector can veto ("this user is
  mid-flow with me"), broken connectors abstain, and login can no longer
  fatal on an unconfigured default connector (#3616773; see the change
  record).
- Kernel test suite grown from 42 to 62 tests.