Retrieve a purchased key after checkout (one-time, no auth required)

Called by the post-checkout redirect with the checkout sessionId. Returns the new key exactly once, then invalidates the retrieval — a second call returns 404. Waits briefly for payment confirmation before giving up. Response envelope note: standalone endpoint — flat {success, key, ...}.