Stripe requires_action loop: finish 3D Secure instead of retrying

# Stripe requires_action loop: finish 3D Secure instead of retrying

## The symptom

`paymentIntents.create` or `confirm` returns `status: 'requires_action'`, or a charge fails with decline code `authentication_required`. The payment sits unfinished and your code keeps retrying the same call.

## Confirm the cause

Inspect the intent:

```js
const pi = await stripe.paymentIntents.retrieve(piId);
console.log(pi.status); // 'requires_action'
console.log(pi.next_action?.type); // 'redirect_to_url' or 'use_stripe_sdk'
```

If `next_action.type` is `redirect_to_url`, the customer must visit `next_action.redirect_to_url.url`. If it is `use_stripe_sdk`, the frontend Stripe.js handles it.

## The fix

This is a customer-present step, not a server retry. Two paths:

**Stripe.js on your page (recommended):** `stripe.confirmPayment({elements, confirmParams: {return_url: 'https://YOUR_HOST/order/complete'}})` pops the bank challenge UI automatically and follows the redirect.

**Manual redirect flow:** send the customer to `next_action.redirect_to_url.url`. After the bank challenge, Stripe returns them to your `return_url` with the PaymentIntent id. Re-retrieve the intent there and check status.

Then handle what comes back:
- `succeeded` - fulfill the order.
- `requires_payment_method` with `last_payment_error.code === 'payment_intent_authentication_failure'` - the customer failed or abandoned the challenge. Ask for a different card.
- Still `requires_action` - the challenge did not complete. Do not loop the confirm call; the customer has to finish the bank step first.

For subscriptions: an off-session renewal that hits `authentication_required` cannot be retried into success. Listen for `invoice.payment_failed`, email the customer a link to re-authenticate, and let them complete it.

## Verify the fix

In test mode use 4000 0025 0000 3155 (requires 3DS) and complete the test challenge; confirm the intent reaches `succeeded`. Use 4000 0084 0000 1629 to simulate a post-authentication decline and confirm your code asks for a new card instead of looping. Fulfillment must key off the `payment_intent.succeeded` webhook, never the client-side return.