Record a completed plan checkout now (owners and admins)

Called when Stripe returns the browser from a completed Checkout, so the subscription is recorded at once instead of when Stripe's checkout.session.completed event arrives. The session is read from Stripe, never trusted from the caller: it must belong to the caller's workspace (another workspace's session is a 404) and be complete and paid (a trial's "no payment required" counts); otherwise confirmed is false and nothing changes. Idempotent with the webhook. Requires billing:manage.