fix(api): only finalize self-serve refunds once the provider confirms (#1731)