Add payment_status guard to payment_intent.succeeded handler

Mirrors the checkout.session.completed case which checks
payment_status === paid before acting. Now checks data.status
=== succeeded on the PaymentIntent object, consistent with how
Stripe structures the event and defensive against any future
edge case where the event fires in a non-final state.

api/webhook.php

@@ -61,7 +61,7 @@ switch ($eventType) {
         // Payment Intent flow (embedded/direct) - skip if already confirmed by checkout.session.completed
         $paymentIntentId = $data['id'] ?? '';
         $orderId         = $data['metadata']['order_id'] ?? '';
-        if ($orderId) {
+        if ($orderId && ($data['status'] ?? '') === 'succeeded') {
             $order = db()->fetch("SELECT * FROM orders WHERE order_id = :id", ['id' => $orderId]);
             if ($order && $order['order_status'] !== 'confirmed') {
                 db()->update('orders',