Prevent Stripe non-card payments from timing out prematurely

[dd32]

Summary

• Delayed payment methods (boleto, OXXO, etc.) complete the Stripe checkout session but payment settlement takes days. Previously the 24-hour CampTix timeout would expire these attendees before payment could complete, causing attendees to lose their tickets.
• When returning from Stripe with an unpaid delayed payment session, attendees are now marked as pending instead of completed, so tickets are not issued until payment actually settles.
• The timeout review now checks both draft and pending attendees. For pending Stripe payments, the timeout is delayed by resetting the attendee timestamp (up to a 7-day maximum safety limit).
• Open Stripe sessions that have not expired according to Stripe are also given extra time before timing out.

Fixes #1532

Test plan

• Purchase a ticket using a delayed payment method (e.g., boleto in test mode)
• Verify the attendee is marked as pending (not published) after returning from Stripe
• Wait for the daily timeout cron to run and verify the attendee is NOT timed out while payment is still pending
• Complete the payment and verify the attendee is correctly marked as published on the next timeout review cycle
• Verify that after 7 days of pending status, the attendee is allowed to time out
• Verify standard card payments still work as before (immediate completion)

Generated with Claude Code