feat(billing): renewals, coupons, VAT numbering, billing cycles and invoice payment tracking

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

tests/Unit/EmailTemplateRendererTest.php

@@ -135,4 +135,31 @@ class EmailTemplateRendererTest extends TestCase
         $this->assertSame('Ưu đãi TGS10', $result['subject']);
         $this->assertSame('<p>TGS10 cho An</p>{{$content}}', $result['html']);
     }
+
+    public function test_renewal_variables_are_escaped_exactly_once(): void
+    {
+        $template = $this->makeTemplate(
+            'Gia hạn {{product_name}}',
+            '<p>{{client_name}} - {{admin_name}}{{server_name_suffix}}</p>',
+            [
+                ['key' => 'product_name', 'label' => 'Dịch vụ', 'type' => 'string'],
+                ['key' => 'client_name', 'label' => 'Khách', 'type' => 'string'],
+                ['key' => 'admin_name', 'label' => 'Nhân viên', 'type' => 'string'],
+                ['key' => 'server_name_suffix', 'label' => 'Máy chủ', 'type' => 'html'],
+            ],
+        );
+
+        $result = (new EmailTemplateRenderer())->render($template, [
+            'product_name' => '<script>x</script>',
+            'client_name' => "A & B's <b>",
+            'admin_name' => '<img src=x onerror=1>',
+            'server_name_suffix' => ' (' . e('<i>vps</i>') . ')',
+        ]);
+
+        $this->assertSame('Gia hạn &lt;script&gt;x&lt;/script&gt;', $result['subject']);
+        $this->assertSame(
+            '<p>A &amp; B&#039;s &lt;b&gt; - &lt;img src=x onerror=1&gt; (&lt;i&gt;vps&lt;/i&gt;)</p>',
+            $result['html'],
+        );
+    }
 }