Tunnel: landing → scan → result (paywall) → Stripe → success → dashboard. Same origin /api/* (Worker or Pages Functions).
/api/*