Redeem a checkout-intent token for a web session (public)

EP-028. Called by the pricing page when arriving from the extension Upgrade (?ci=...). Consumes the token (single-use) and establishes a web SESSION for its account on this domain (Set-Cookie: session + readable p2m_auth hint, mirroring the OAuth login), so the page then behaves as a normal signed-in buyer — current plan, Manage billing, checkout and retries — with no email prompt. Returns the account email for the "Upgrading as ..." label. 404 on invalid/expired.