Called when a customer pastes a payment reference from a previous attempt — typically
after a scan that was paid for but never completed.

Checks, in order (the first failure wins):

1. Reference exists → else not_found
2. Belongs to this vendor → else wrong_vendor
3. Terminal status (a pending row is refreshed against the provider first) →
   else pending, or failed for a payment that did not succeed
4. Email matches the one captured at payment → else wrong_email
5. Value not yet delivered → else used

Resumable (resumable: true): the customer paid but never got their scan. The widget
skips checkout and threads batch_id + the reference into POST /skin/analyze.

Used (reason: "used"): the reference is spent — it buys exactly one scan and that
scan already ran. The response carries the delivered batch_id when the scan is still
readable, so the widget can show the customer the results they already paid for rather
than a dead end. Re-running the analysis is NOT offered; this is a read.

Because the email check runs before both outcomes, a leaked reference alone reveals
nothing — the results read is gated on the same proof of identity as a resume.