Stripe event: checkout.session.expired, release what you held and consider the recovery email

# checkout.session.expired: clean up and optionally recover

The Checkout Session expired without payment (sessions expire 24 hours after creation by default). The customer is gone, but your system may still be holding things for them.

## What to do on receipt

1. Release anything you held for this session: reserved inventory, held seats, locked promo codes, temporary accounts. If you do not, they leak.
2. Mark the checkout attempt abandoned in your records, linked to the customer if you know who they were.
3. Optionally send a recovery email: "still interested?" with a fresh checkout link. This is one of the highest-ROI emails in ecommerce; the event hands you the trigger for free.
4. Return 200.

## The trap

No handler at all. Most integrations listen for `completed` and ignore `expired`, so abandoned sessions pile up as phantom reservations. The subtler trap: treating `expired` as a failure to retry automatically. Do not create a new session unprompted; invite, do not ambush.

## Checklist

- You can set a custom expiry with `expires_at` when creating the session (between 30 minutes and 24 hours). If you do, your cleanup timing should match your setting, not the default.
- Distinguish `expired` from `async_payment_failed`. Expired means the customer walked away. The async failure events mean they tried and the money failed; those get dunning, not recovery emails.