Create Msa Order

Public, unauthenticated MSA order intake.

Creates a claim under the self-service org with payment_status="pending", persists uploaded documents to the backend's file_store, and returns a Stripe checkout URL. The webhook flips payment_status to "paid" and starts the 48h SLA on checkout.session.completed.

Owns file storage: avoids cross-service filesystem split (the Next.js proxy used to write files locally and the API couldn't read them in prod).