Lock a stay fare for purchase. Requires the Mercury fareId (UUID) returned by POST /v1/stays/fares; unknown or expired identifiers return 410 OFFER_EXPIRED. Accepts either an authenticated bearer token or a guest session token. Guest principals run the build through the service-account session's retry-once wrapper; on success the guest's checkout session is stamped with the locked fare id and expiry.