revise ads and alerts

controllers/client/tiers.controller.js

@@ -300,6 +300,19 @@ exports.captureOrder = async (req, res) => {
 
     const capture = captureData.purchase_units?.[0]?.payments?.captures?.[0];
 
+    // PayPal can return an HTTP 2xx from the capture endpoint even when the
+    // charge itself was declined or held for review (e.g. capture.status
+    // "DECLINED"/"PENDING") — axios only throws on non-2xx, so the actual
+    // status field must be checked explicitly before granting any access.
+    const captureStatus = capture?.status ?? captureData.status;
+    if (captureStatus !== 'COMPLETED') {
+      await payment.update({
+        status:           'failed',
+        provider_payload: { ...payment.provider_payload, capture: captureData, failed_reason: captureStatus ?? 'unknown' },
+      });
+      return R.error(res, `Payment was not completed by PayPal (status: ${captureStatus ?? 'unknown'}).`, 402);
+    }
+
     // Repurchasing a plan under a tier already held active extends the
     // existing grant's expires_at by the new plan's duration, rather than
     // being blocked/refunded — the original plan_id is kept (whichever plan