Confirm an SMS purchase quote

Buy what the quote binds, with its single-use confirm_token. It charges the workspace: confirm only after the person agreed to the quoted price. Requires an Idempotency-Key: a retry with the same key answers what the first call answered and never charges twice. The order runs exactly as in the dashboard: the plan's purchase rules, the one-time fee taken from the plan's allowance before carriers are called and refunded if they refuse the submission, the monthly fee from when the number leases or carriers approve the campaign. Every API purchase counts against the monthly API spend cap the workspace owner sets in the dashboard (the fee due now plus the first month, per UTC month); with no cap set, API purchases are refused. The owner gets an email per purchase, and the activity log names the key. Refusals charge nothing: a changed price (price_changed), an expired quote (quote_expired), a brand or messaging program edited since (quote_stale), a quote already used (quote_already_used), an order for the same purchase still in flight (conflict, naming its quote). These refusals are answered before the shared hourly limits are spent. A confirm that recorded nothing leaves the quote open (and frees its Idempotency-Key); one that reached carriers spends it: failed when carriers refused it (quote again), pending when their answer is unknown (follow the quote; don't buy the same thing meanwhile). Requires the sms:purchase capability.