Withdraw Onboard Redirect

Mint a fresh Stripe onboarding link on demand.

The frontend page at /withdraw/onboard calls this endpoint with the current user's JWT, then redirects the browser to the returned URL. That indirection lets us send durable links in emails / Stripe refresh_url even though the Stripe account links themselves are short-lived and single-use.