Where the checkout returns the buyer, showing the token the webhook created.

Accepts several identifiers because the checkout provider's redirect variables differ by product and can change; whichever one arrives is used, and a recent row for the buyer's email is the last resort. The webhook can also land after the redirect, so an unmatched request says "being set up" rather than erroring, which is true and actionable rather than alarming.