fix(saas): resume open Stripe checkout safely

[venelouis]

Summary

• resume a provider-confirmed open Stripe Checkout Session instead of inserting a conflicting attempt
• check the new-session limiter only after resolving an existing attempt
• validate test mode, metadata, hashed client reference, session ID and exact Stripe Checkout host before redirecting
• close expired sessions, return completed sessions to local processing and include Retry-After on 429
• document APP-SAAS-003 as an application issue, not a framework defect

Evidence

Azure staging logs showed a successful 303 session creation followed by 409 for the existing attempt and then 429. No personal or provider identifiers are included here.

Verification

• cargo test --manifest-path blueprints/saas/Cargo.toml --all-targets -j 2 (19 passed)
• cargo clippy --manifest-path blueprints/saas/Cargo.toml --all-targets -j 2 -- -D warnings
• git diff --check

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.