Checkout Session Updated

The checkout session snapshot. One schema is shared by the REST endpoints and the checkout.session.* webhook bodies.

Invariant on payment_resource_url / payment_resource_client_secret: they are populated only on responses served from live workflow state over the authenticated API while the session is unpaid, and are always None everywhere else. In particular they are never populated in a webhook body — the todo row, the logbook and the delivery pipeline all retain what they are handed, so payment material must not enter any of them. Two things hold that: from_row never sets the pair, and PublishCheckoutSessionEventTodoContext strips it on validation, before the event is persisted or recorded. Once the session leaves unpaid they are None on every response, because the material is no longer actionable.