feat: add admin frontend for subscription and billing management

Add admin pages for managing subscription tiers, vendor subscriptions,
and billing history:

- Subscription Tiers page: Create, edit, activate/deactivate tiers
- Vendor Subscriptions page: View/edit subscriptions, custom limits
- Billing History page: View invoices with filters and PDF links
- Stats dashboard with MRR/ARR calculations

Also includes:
- Pydantic schemas for billing operations (models/schema/billing.py)
- Admin subscription service layer for database operations
- Security validation fixes (SEC-001, SEC-021, SEC-022)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

app/routes/admin_pages.py

@@ -876,6 +876,68 @@ async def admin_vendor_product_edit_page(
     )
 
 
+# ============================================================================
+# BILLING & SUBSCRIPTIONS ROUTES
+# ============================================================================
+
+
+@router.get("/subscription-tiers", response_class=HTMLResponse, include_in_schema=False)
+async def admin_subscription_tiers_page(
+    request: Request,
+    current_user: User = Depends(get_current_admin_from_cookie_or_header),
+    db: Session = Depends(get_db),
+):
+    """
+    Render subscription tiers management page.
+    Shows all subscription tiers with their limits and pricing.
+    """
+    return templates.TemplateResponse(
+        "admin/subscription-tiers.html",
+        {
+            "request": request,
+            "user": current_user,
+        },
+    )
+
+
+@router.get("/subscriptions", response_class=HTMLResponse, include_in_schema=False)
+async def admin_subscriptions_page(
+    request: Request,
+    current_user: User = Depends(get_current_admin_from_cookie_or_header),
+    db: Session = Depends(get_db),
+):
+    """
+    Render vendor subscriptions management page.
+    Shows all vendor subscriptions with status and usage.
+    """
+    return templates.TemplateResponse(
+        "admin/subscriptions.html",
+        {
+            "request": request,
+            "user": current_user,
+        },
+    )
+
+
+@router.get("/billing-history", response_class=HTMLResponse, include_in_schema=False)
+async def admin_billing_history_page(
+    request: Request,
+    current_user: User = Depends(get_current_admin_from_cookie_or_header),
+    db: Session = Depends(get_db),
+):
+    """
+    Render billing history page.
+    Shows invoices and payments across all vendors.
+    """
+    return templates.TemplateResponse(
+        "admin/billing-history.html",
+        {
+            "request": request,
+            "user": current_user,
+        },
+    )
+
+
 # ============================================================================
 # SETTINGS ROUTES
 # ============================================================================