refactor(helcim): wrapped PATCH body, first-activation welcome email guard

Moves updateHelcimSubscription to the live-verified wrapped shape
(PATCH /subscriptions { subscriptions: [{ id, ...payload }] }), adds a prior-
status check so sendWelcomeEmail only fires on pending_payment to active
transitions, short-circuits get-or-create-customer when a valid
helcimCustomerId is already on file, and replaces member.save() Slack-status
writes with findByIdAndUpdate({ runValidators: false }) to avoid save-time
validator pitfalls.

server/utils/helcim.js

@@ -97,7 +97,11 @@ export const cancelHelcimSubscription = (id) =>
   helcimFetch(`/subscriptions/${id}`, { method: 'DELETE', errorMessage: 'Subscription cancellation failed' })
 
 export const updateHelcimSubscription = (id, payload) =>
-  helcimFetch(`/subscriptions/${id}`, { method: 'PATCH', body: payload, errorMessage: 'Subscription update failed' })
+  helcimFetch('/subscriptions', {
+    method: 'PATCH',
+    body: { subscriptions: [{ id: String(id), ...payload }] },
+    errorMessage: 'Subscription update failed'
+  })
 
 // ---- Payment plans (admin) ----