Open Portal Via Token

Durable billing-portal entry point (the emailed / dashboard link).

token is a long-lived, single-purpose, customer-scoped opaque handle (billing.get_or_create_portal_token). It is NOT a login or session token: it can ONLY open this one customer's Stripe billing portal (change / cancel plan, update card, view invoices). Because it never authenticates the user into their account and grants no API access, a long TTL is acceptable here in a way it is not for password-reset or magic-login links. It remains revocable and customer-scoped.

On every visit we mint a FRESH Stripe portal session server-side and 302 into it, so this link never goes stale even though the underlying Stripe session URL expires within minutes.