Finalize a domain purchase after the embedded payment completes

Verifies the session, registers the domain, captures the charge, and auto-connects the domain. Idempotent per session id (the Stripe webhook drives the same path server-side, so a closed tab never strands a paid session). 201 on first fulfillment, 200 on an idempotent replay. Exactly one caller fulfills a session: the first to claim its order registers the domain and captures the charge, and a caller that arrives while it is still working waits briefly, then gets that result or a 409 with code fulfillment_in_progress. A 409 never releases the authorization; retry the call, or read GET /v1/sell/orders/{id}, to see the outcome.