Paywall Topup Choice

Stamp the paywall door onto the pending SetupIntent (prepay-match test).

Called by the checkout form right before confirmSetup so the setup_intent.succeeded webhook — the single grant boundary — sees the final choice. Metadata updates merge, so device_id / domain stay. A stale SI (decline → refreshAfterDecline) is re-stamped on the next submit because the form calls this on every attempt.