Post Signup Setup Intent

Step 3 (mount): create a Stripe SetupIntent for the pending row and return the clientSecret the frontend uses to mount Stripe's PaymentElement. The pending_user_id is stamped into the SetupIntent's metadata so the Phase 11 webhook can correlate Stripe events back to the User.

Only pending rows can advance — active/abandoned/cancelled rows would create orphan SetupIntents on retry. The Stripe SDK call is wrapped in asyncio.to_thread (it's sync; we don't want to block the event loop).