Enforce domain setup entitlement and preserve working domains on replacement failure

[philipithomas]

Custom-domain setup currently relies on a presentation-time checkout check, and replacing a domain can remove the working registration before the replacement is known to be valid.

On main 6722c6b, SetupController#show skips checkout whenever a session_id parameter is present; it does not retrieve or verify that Checkout session. SetupController#update handles domain_connect without checking active_subscription? at all. An authenticated owner without an active subscription can therefore reach the domain-registration operation without established payment entitlement. This is a source-confirmed authorization gap; no live checkout or domain registration was attempted during the audit.

Separately, add_domain destroys the account's existing domains before Domain.register validates/registers the replacement. The model preflight added in #77 cannot preserve registrations already deleted by the controller.

Acceptance:

• Enforce account entitlement at each operation that registers or purchases a domain; never use presence of an unverified query parameter as proof of payment.
• Handle legitimate checkout-return/webhook timing with verified, account-scoped payment state. Test missing, arbitrary, foreign, unpaid, paid, expired and replayed session IDs, plus direct update requests.
• Preserve the active domain when replacement validation or the provider fails. Define replacement/reconciliation semantics for partial provider success and retries.
• Test existing-domain replacement, malformed/new long-TLD host, provider timeout/failure, duplicate, cancellation, and ownership isolation using provider doubles.
• Include the Pay/Stripe migration in Upgrade Pay with verified billing data migrations and Stripe regression coverage #79 in compatibility testing; avoid making external calls or charging accounts in tests.

[philipithomas]

The Stripe follow-up audit confirmed the same unchecked session_id pattern in app/controllers/concerns/payment_required.rb:14, in addition to SetupController. Include the shared PaymentRequired concern in this issue's scope. Its current “webhook pending” shortcut accepts any supplied value without retrieving a session or checking customer ownership/subscription status.

The fix must preserve the current trial and access policies while granting entitlement only from verified, account-scoped state. Include checkout-return-before-webhook, arbitrary/foreign/unpaid/expired session IDs and direct domain update requests in regression coverage. The SDK/data migration and current target versions are recorded in #79. This remains source-confirmed; no live billing or domain operation was attempted.