Fix Stripe checkout return URLs so post-payment verification runs

Commit notes

The frontend appended ?verify=true / ?subscription=success to redirect URLs and the backend then appended a second ?session_id=..., producing malformed double-? success URLs whose params never parsed — so the payment-success flow never fired, while the clean cancel_url triggered it on cancel instead.

- Add appendRawQuery helper that joins with ? or & correctly without encoding Stripe's {CHECKOUT_SESSION_ID} template; use it for all three success_url call sites (pack, bundle, subscription checkout) - Send clean redirect URLs from the frontend (origin + pathname; bare /library for subscriptions) so cancel returns carry no marker - Gate pack/bundle verification on session_id presence (keeping legacy verify=true acceptance for deploy skew) and clean both params from the URL afterward - Preserve remaining query params in the library page URL cleanup and also strip session_id there

Co-Authored-By: Claude Fable 5 <[email redacted]> Claude-Session: [private session redacted]