#2606 A collective that cancels inside its 30-day trial window regains trial access to private extensions

A collective that subscribes to a paid plan and then cancels while its creation-time trial clock (trigger collective_created) is still running falls back to trial entitlement for private extensions.

Where

collectiveEntitled in lib/app/billing/private-extension-entitlement.ts checks sub.grantsAccess() first. If that fails, it returns collective.trialStatus().state === "active" without reading everGrantedAccess.

Why it looks wrong

AGENTS.md: "Entitlement is remembered, not sampled: a collective that has ever held an entitling subscription can never start a trial." The trial-ended sweep (trial-ended-watch.ts) and the trial door both honour everGrantedAccess, but this entitlement fallback does not. A churned customer keeps private-extension access until day 30 of a trial they converted out of.

Separately, content/manual/reference/api-key-authentication.md says "The trial grants no entitlement". That contradicts this code path either way; whichever behaviour is intended, one of the two is wrong.

Steps

1. Create a collective (trial starts, collective_created).
2. Subscribe to Team, then cancel (status canceled, everGrantedAccess: true) within 30 days.
3. collectiveCanUsePrivateExtensions returns true.

Expected

Decide whether a churned collective should fall back to its trial. If not, gate the fallback on !everGrantedAccess. Also fix the manual line.

Found while triaging #2541.