Agent Checkout Link

Generate a Stripe Checkout URL for a tier upgrade.

Two modes, picked by whether the caller can prove they control the target email:

1. Authenticated agent flow. Caller sends X-API-Key or ?apiKey= and the key's email matches body["email"]. We return the Stripe Checkout URL synchronously so the agent can paste it to the user. This is the documented happy path for an MCP/agent helping the key's owner upgrade.

2. Unauthenticated request. No API key, or the key's email doesn't match. We DON'T return a checkout URL. Instead we email a one-shot signed link to body["email"] that lands on /dashboard?checkout_tier=<tier> after magic-link login. The recipient has to actually open their inbox and click; an attacker can't generate a Stripe-Checkout-bound-to-victim URL without controlling the victim's email.

This closes the phishing vector flagged in the 2026-05-20 audit P0 1.12: previously the route returned a Stripe URL for ANY email after passing only the per-IP signup throttle.