Resolve a 3DS payment-recovery link

Runs payment.resolveCheckoutRecovery. Public by design — the caller is a guest or signed-in customer who followed the requires_action email link with no other credential (critical decision #4). Never throws for an unknown, expired, or wrong-state token: every outcome, including one that doesn't resolve to anything, is a distinct kind in the 200 body, so a probing caller and a legitimate one get the same shape of answer either way. When kind is resumable, the response carries a freshly-fetched Stripe client secret — re-fetched from Stripe on every call, never read from a stored column, and never logged — for the SAME PaymentIntent the original checkout created. Rate-limited like the rest of the write-tier payment surface even though this route never charges anything, because it calls out to Stripe on every resolve.