Get Checkout Session Status

Report whether an in-flight embedded Checkout Session has already failed.

The embedded checkout iframe owns the 3-D Secure challenge, so when the issuer's ACS page hangs the browser has no way to learn that Stripe already gave up on the authentication behind it. The registration UI polls this so it can replace a dead blank overlay with a real error and a retry.

organization_id is optional. The session already names its organization (metadata / client_reference_id), so the caller's copy is only an early, Stripe-free cross-check. It became required in #3004 and every browser still running the previous bundle - which polls without it - got a 422 on every tick, so the poll that exists to break the 3-D Secure deadlock never fired. A required parameter added to a live endpoint breaks every tab already open across the deploy; the same checks now run either way, just as early as the information allows.