Post-checkout landing. Doubles as an IDEMPOTENT credit backstop for card topups.

The webhook is the primary credit path; this handler is a second, independent trigger so a missed/failed single webhook delivery can't strand a paid-but-uncredited topup. Both funnel through the status-row-guarded _credit_card_topup, so a double-fire credits once. Never raises — a landing page must render even if Stripe lookup hiccups.