When free=1 is in the URL, verify order status via API instead of
looking for a Stripe session. Checks payment_status=paid on the
server side — no security hole since the server already validated
the discount code before marking the order paid.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>