chore(billing): plan-limit notify follow-ups from the #4648 stack review — day-boundary cadence, dismiss≠mute decision, comp'd-user scanner blindness

Three residuals identified and deliberately deferred during the adversarial review of the plan-limit notification stack (#4648 / #4665 / #4672, reviewed at heads fa37578e4 / df5d6f5c9 / 844de7683). Each was verified real but non-blocking; none is fixed by the stack.

## 1. Day-boundary burst-notice cadence hole

Burst notice identity is per-UTC-day (`noticeWindowKey = utcDayKey(now)` in `convex/apiPlanLimitUsage.ts`), so a burst spanning midnight mints a fresh `pending` notice with no `lastEmailedAt` — a customer can be emailed at 23:18 and again shortly after 00:00, defeating the 6h cadence at the boundary. Bounded to one extra email/day/dimension. Fix needs cadence/`lastEmailedAt` carry-over across the day boundary (match on `(user, dimension, state)` rather than the day-scoped dedupe key when computing email due-ness).

## 2. Dismiss ≠ mute (product decision needed)

`acknowledgedAt` hides the in-app banner (`listCurrentForUser`) but `listEmailDue` doesn't consult it — a user who dismissed the banner keeps receiving the cadence emails while over limit. Possibly intended (email as independent channel), but it should be a recorded decision, not an accident. Note: `getEnforcementReadiness` currently has no consumers (diagnostic-only), so muting on dismiss would not yet affect enforcement gating either way.

## 3. Comp'd users invisible to the scanner

Entitlements with `compUntil` in the future but `validUntil` past are not returned by `listActivePaidEntitlements`, so comp'd accounts are invisible to the plan-limit scanner — their usage is never evaluated AND any pre-existing notices sweep-clear as "recovered" while usage may continue. Needs an entitlement-model-aware query (include comp-covered rows) or an explicit statement that comp'd accounts are exempt from plan-limit notices.

## Context

Full review threads live on the PRs' review artifacts (ce-code-review run 20260705-081509-950a3d09). Related: #4635 (epic), #4797 (server-side checkout stacking boundary — separately tracked).

Start with convex/apiPlanLimitUsage.ts and trace how noticeWindowKey, lastEmailedAt, listCurrentForUser, and listEmailDue handle cadence and dismissal. Then inspect listActivePaidEntitlements and the entitlement fields compUntil and validUntil. Done requires a recorded dismiss-versus-mute decision, correct day-boundary cadence behavior, and an explicit or implemented policy for comped accounts, with tests covering all three cases.

Written by the indexing model from the issue text.