Allow Cart-Session to Update the ec_token

[mmaymo]

Description

Allow PUT /merchant-cart/{id} to create PayPal orders when needed
Per PayPal spec, the PUT endpoint can create a new ec_token when the cart doesn't have one (e.g., POST validation failed) or the existing token expired.

update_cart_session() now accepts optional $ec_token parameter. When provided, replaces stored token; when null, preserves existing.
ReplaceCartEndpoint checks if cart needs a new token (empty or expired) and calls order_manager->create_order() if the cart is valid. New token is passed to session handler and included in response.
Added UpdatedCartWithTokenResponse for PUT responses that include a new token. payment_method.token is only present in response when a new token was actually created.
Files:

AgenticSessionHandler.php - optional $ec_token param
AgenticRestEndpoint.php - pass token through store_local_cart()
ReplaceCartEndpoint.php - token creation logic
ResponseFactory.php - new cart_with_token() method
UpdatedCartWithTokenResponse.php - new response class

Behavior:

POST with invalid items → no token created
PUT to fix items → token created, included in response
PUT on cart with valid token → token preserved, not in response
Checkout → only reads existing token, never creates

[danieldudzic]

There seems to be a filename typo — UpdatedCartWithTokenRespones.php instead of UpdatedCartWithTokenRespone.php.

[danieldudzic]

Thanks for working on this! Just a few points to address, and should be good to go 🙌

[danieldudzic]

@mmaymo Thanks for working on this. We need just one more change, I think.

[stracker-phil]

I had to rewrite this PR (actually Claude did) as this PR had a significant drift from the epic code already.

Thanks for the research and PR, it was very helpful to understand the problem and re-apply it to the current epic code!