Create a TEST-mode Stripe PaymentIntent for the invoice (unauthenticated)

AR charge rail (Stage 3 — TEST MODE ONLY). UNAUTHENTICATED; rate-limited per-IP and per-token. The request body is EMPTY and ignored: the amount is SERVER-authoritative (outstanding = amount − paid; force-absorb means the payer is charged the principal only), and no caller-supplied field reaches the intent — the idempotency key is a pure function of (token, outstanding), so one pay link yields at most ONE PaymentIntent. (The payer's card receipt is set browser-side at confirm time via Stripe's receipt_email.) Returns { clientSecret, publishableKey (TEST), connectedAccountId, amountChargedCents } for Stripe.js; the card is tokenized in-browser and PAN/CVC never reach this API. Marks nothing paid — settlement is the signature-verified Stage-4 webhook. Same uniform-404 token gate as the GET.