fix(subscriptions): prevent duplicate external_ids per organization

[endenis]

Fixes BIL-44

Context

Multiple active subscriptions with the same external_id could coexist within the same organization for different customers.

The model validation only ran on :create missing status changes (like pending => active).

There was also no database-level unique index.

Description

In this PR:

• Subscription model validation validate_external_id is now set to run on updates too
• Added a service-level cross-customer check in Subscriptions::CreateService
• Simplified the "with multuple subscriptions" tests for SubscriptionsController. They were by accident creating two active subscriptions and validations now block that
• Did not add any unique index to the database. This should be discussed further and handled separately.

[vincent-pochet]

Looks good