fix(revoke): finalize sweep marks a flagged row revoked even when no Azure Return was posted #1523

Problem

The finalize_revocations sweep marks every flagged, unrevoked purchase row as revoked. If a request crashes after it sets revocation_in_flight but before it posts the Azure Return (or the flip's commit result is lost), the row stays flagged. The sweep then marks it revoked even though no refund was posted. The purchase looks refunded while it is still active and billed.

This was already the case before #1516 and #1520; neither makes it worse.

Proposal

Record when the Return is actually posted (for example a return_posted_at stamp, or the Azure return ID) and have the sweep only finalize rows that have it. Rows that are flagged but have no Return should be cleared after a timeout or flagged for an operator, not marked revoked.

Acceptance criteria

• A real-Postgres test: a row flagged without a recorded Return is not marked revoked by the sweep.
• A row whose Return was recorded is still finalized as today.

Refs #316, #1518