Abandon Checkout

Customer-initiated checkout abandonment.

No cancel_secret required: anyone who has the checkout URL can already walk away from their own checkout. This endpoint just makes the abandonment EXPLICIT to the platform — without it, the merchant order stays in Pending indefinitely, and OpenCart's algovoi.callback polling our /status would still see active, leading to confusing UX where a cancelled checkout returns to the merchant's checkout page instead of the merchant's "order cancelled" page.

Only active links can be abandoned:

• paid → 409 Conflict (let the JS show "Payment confirmed" instead)
• cancelled→ 200 (idempotent — already cancelled)
• expired → 410 Gone

On success: marks link.status = 'cancelled' AND notifies the merchant platform (OpenCart etc.) to mark the order as Cancelled on their side. Always returns the redirect_url so the JS can wire the "Return to store" link target.