App subscriptions: manage a user's subscriptions with the app's own token

- $user->appSubscriptions(): create (idempotency_key), find, all, checkout, revoke, pause,
  resume, update against /v1/client/subscriptions with a client credentials token, so apps don't
  depend on the user's login
- user id from the billable's anikeen_id (AnikeenId::useUserIdField())
- ApiException with status, stable error code, isNotFound/isConflict/isTemporary; network
  errors no longer escape as raw Guzzle exceptions
- rejected app tokens are renewed once; asApp() never changes the shared client's token
- tests (testbench + Guzzle mock) and CI

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/Id/Concerns/ManagesSubscriptions.php

@@ -1,27 +1,38 @@
-<?php
-
-namespace Anikeen\Id\Concerns;
-
-use Anikeen\Id\Resources\Subscriptions;
-use Throwable;
-
-trait ManagesSubscriptions
-{
-    use HasBillable;
-
-    /**
-     * Get subscriptions from the current user.
-     *
-     * @throws Throwable
-     */
-    public function subscriptions(): Subscriptions
-    {
-        if (!isset($this->subscriptionsCache)) {
-            $this->subscriptionsCache = Subscriptions::builder(fn() => $this->anikeenId()
-                ->request('GET', 'v1/subscriptions'))
-                ->setBillable($this);
-        }
-
-        return $this->subscriptionsCache;
-    }
+<?php
+
+namespace Anikeen\Id\Concerns;
+
+use Anikeen\Id\Resources\AppSubscriptions;
+use Anikeen\Id\Resources\Subscriptions;
+use Throwable;
+
+trait ManagesSubscriptions
+{
+    use HasBillable;
+
+    /**
+     * Get subscriptions from the current user.
+     *
+     * @throws Throwable
+     */
+    public function subscriptions(): Subscriptions
+    {
+        if (!isset($this->subscriptionsCache)) {
+            $this->subscriptionsCache = Subscriptions::builder(fn() => $this->anikeenId()
+                ->request('GET', 'v1/subscriptions'))
+                ->setBillable($this);
+        }
+
+        return $this->subscriptionsCache;
+    }
+
+    /**
+     * The user's subscriptions, managed with the app's own token instead of the user's
+     * (trusted apps only, scope subscriptions:client). Use this in jobs and anywhere the user's
+     * login may have expired.
+     */
+    public function appSubscriptions(): AppSubscriptions
+    {
+        return new AppSubscriptions($this);
+    }
 }