Create a checkout session

Creates a checkout session (DB only, no order, no external API calls). The order is created separately via POST /orders with checkoutSessionId.