One-click payment-method update (from billing email link)

Public endpoint (no authentication required). The link is minted into Winnr billing emails (payment failure, upcoming-renewal and expiring-card notices, domains disabled). t is a signed token bound to the account and its Stripe customer that expires after 30 days. A valid token redirects (302) to a Stripe Billing Portal session limited to adding a payment method, which returns to Settings when done. Opening the link changes nothing by itself, so mail scanners that prefetch it are harmless. Rate limited per IP.