Fix duplicate order confirmation email on Stripe Checkout

When using Stripe Checkout, both checkout.session.completed and
payment_intent.succeeded fire for the same payment. After the stripe.php
change propagated order_id into PI metadata, the PI handler also found
an order_id and sent a second confirmation email.

Fix: fetch the order first in payment_intent.succeeded and skip if
already confirmed. Also records stripe_payment_intent in this path
for direct PI flows that bypass checkout.session.completed.

api/webhook.php

@@ -57,14 +57,17 @@ switch ($eventType) {
         break;
 
     case 'payment_intent.succeeded':
-        // Payment Intent flow (embedded checkout) — metadata.order_id set directly on PI
+        // Payment Intent flow (embedded/direct) - skip if already confirmed by checkout.session.completed
         $paymentIntentId = $data['id'] ?? '';
         $orderId         = $data['metadata']['order_id'] ?? '';
         if ($orderId) {
+            $order = db()->fetch("SELECT * FROM orders WHERE order_id = :id", ['id' => $orderId]);
+            if ($order && $order['order_status'] !== 'confirmed') {
                 db()->update('orders',
                     [
                         'payment_status'        => 'paid',
                         'order_status'          => 'confirmed',
+                        'stripe_payment_intent' => $paymentIntentId,
                     ],
                     'order_id = :id',
                     ['id' => $orderId]
@@ -74,6 +77,7 @@ switch ($eventType) {
                     sendOrderConfirmationEmail($order);
                 }
             }
+        }
         break;
 
     case 'payment_intent.payment_failed':