Purchase credits

May charge the default method. Requires an approved current quote and catalogVersion. Retry uncertain outcomes with the same checkout UUID and payload; a different quantity/version needs a new UUID. Requires-action outcomes send the buyer to Dashboard without exposing payment secrets. Requires billing.write, a verified person and owner role. Subject to rollout-agent-access-writes (default off) and allow-public-agent-writes before account/provider effects. Return and person handoff URLs always use the canonical Dashboard origin; redirect URLs, payment details and provider tokens are not accepted.