feat(founder): payment→register flow + founder-only registration gate

- Next API routes: /api/register + /api/checkout (Stripe session) + /api/stripe-webhook
  (signature-verified; fulfils through be-crm), ported from the landing's serverless
  functions. Shared founder lead validation in src/lib/founder/lead.ts.
- /api/founder/lookup + /api/founder/session proxy be-crm's public endpoints.
- /thanks polls session_id → founder token → redirects to /portal/register?ft=<token>;
  falls back to the emailed link if the webhook is briefly delayed.
- register-flow: reads ?ft=, validates + prefills (email locked, name, phone) from the
  paid founder record, passes founderToken to crm.account.register (claims token +
  provisions owner). Open registration is now blocked — only a paid founder (ft) or a
  team invitee may register; everyone else sees a 'Founder access required' gate.

src/app/api/founder/session/route.ts

@@ -0,0 +1,27 @@
+import { NextResponse } from "next/server";
+
+// Server-side proxy to be-crm's founder-access by-session lookup. The /thanks page
+// (post-Stripe) polls this with the checkout session_id until the webhook has
+// fulfilled the purchase and a founder token exists, then redirects to the
+// prefilled register page. `pending` means "poll again shortly".
+
+export const runtime = "nodejs";
+
+const CRM_BASE_URL = (process.env.CRM_BASE_URL ?? "https://crm.lynkedup.cloud").replace(/\/$/, "");
+
+export async function GET(request: Request) {
+  const sessionId = new URL(request.url).searchParams.get("session_id") ?? "";
+  if (!sessionId || sessionId.length > 256) {
+    return NextResponse.json({ ok: false, status: "pending" }, { status: 400 });
+  }
+  try {
+    const res = await fetch(`${CRM_BASE_URL}/public/founder-access/by-session?session_id=${encodeURIComponent(sessionId)}`, {
+      headers: { Accept: "application/json" },
+      cache: "no-store",
+    });
+    if (!res.ok) return NextResponse.json({ ok: false, status: "pending" }, { status: 502 });
+    return NextResponse.json(await res.json());
+  } catch {
+    return NextResponse.json({ ok: false, status: "pending" }, { status: 502 });
+  }
+}