Add per-store managers for Woo Business accounts.

Agencies can invite store-scoped managers via Identity, with access limited to one WooCommerce store while owners retain full multi-store control.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Controllers/Woo/ProController.php

@@ -21,6 +21,7 @@ class ProController extends Controller
 
     public function index(Request $request): View
     {
+        $this->guardBillingOwner($request);
         $user = $this->accountUser($request);
         $planKey = $this->subscriptions->planKey($user);
 
@@ -44,6 +45,7 @@ class ProController extends Controller
 
     public function subscribe(Request $request): RedirectResponse
     {
+        $this->guardBillingOwner($request);
         [$ok, $message] = $this->subscriptions->subscribe($this->accountUser($request));
 
         return redirect()->route('woo.pro.index')->with($ok ? 'success' : 'error', $message);
@@ -51,6 +53,7 @@ class ProController extends Controller
 
     public function subscribeEnterprise(Request $request): RedirectResponse
     {
+        $this->guardBillingOwner($request);
         [$ok, $message] = $this->subscriptions->subscribeEnterprise($this->accountUser($request));
 
         return redirect()->route('woo.pro.index')->with($ok ? 'success' : 'error', $message);
@@ -58,6 +61,7 @@ class ProController extends Controller
 
     public function subscribePrepaid(Request $request, BillingClient $billing): RedirectResponse
     {
+        $this->guardBillingOwner($request);
         $validated = $request->validate([
             'plan' => ['required', 'in:pro,enterprise'],
             'months' => ['required', 'integer', 'in:6,12,24'],
@@ -137,8 +141,14 @@ class ProController extends Controller
 
     public function cancel(Request $request): RedirectResponse
     {
+        $this->guardBillingOwner($request);
         [$ok, $message] = $this->subscriptions->cancel($this->accountUser($request));
 
         return redirect()->route('woo.pro.index')->with($ok ? 'success' : 'error', $message);
     }
+
+    private function guardBillingOwner(Request $request): void
+    {
+        abort_if($this->wooMember($request), 403);
+    }
 }