Pending Payment

Rehydrate an unresolved, authenticated plan-change payment.

Recovery intentionally does NOT depend on require_billing_enabled. BILLING_ENABLED prevents creation of new money-moving operations; it must not strand a hosted invoice created before the kill switch flipped.

The canonical subscription id and customer id both come from the authenticated user's row. Stripe is then re-read with the invoice expanded and both identities are checked again before any URL is returned. No local plan state is changed here; signed Stripe webhooks remain the sole entitlement writer.