v1.0.1: card payment at checkout

Card payment at checkout, with Stripe as the first card provider.

• Card checkout. A shopper can pay by card at checkout. Stripe is offered in an embedded Payment Element form or on a hosted Checkout page. Each payment method row picks its checkoutMode.
• Provider agnostic payment action. Placing an order answers with a paymentAction: none, redirect, form_post or embedded. The storefront has one handler for all four, so a new provider needs no storefront change unless it is embedded.
• Payment retry and confirm. POST /v1/orders/:id/payment starts a fresh payment for an unpaid order. POST /v1/orders/:id/payment/confirm asks the provider for the live status when the shopper comes back. Both need X-Idempotency-Key. Webhooks stay the source of truth.
• Credentials in the admin. The operator enters the provider keys on the payment method form. Secret fields are encrypted at rest (AES-256-GCM) with PAYMENT_CONFIG_ENCRYPTION_KEY. Without that key, saving a secret answers PAYMENT_CONFIG_ENCRYPTION_UNAVAILABLE. STRIPE_API_KEY, STRIPE_WEBHOOK_SECRET and STRIPE_PUBLISHABLE_KEY still work as a fallback.
• Several payment methods can be active at once, each with its own keys.
• New stable error codes: CATEGORY_SLUG_TAKEN, CATEGORY_HAS_PRODUCTS, REVIEW_ALREADY_PUBLISHED, QUESTION_ALREADY_PUBLISHED.

More card providers plug in behind one interface. Each one is its own open issue, see the roadmap: https://github.com/Xdabier/themerchantengine/blob/main/ROADMAP.md

Full list: https://github.com/Xdabier/themerchantengine/blob/main/CHANGELOG.md

v1.0.0

The first public release of the engine, under the MIT License.

Major Changes

• MIT License. LICENSE holds the MIT text and NOTICE the copyright and
  the trademark note. The four package files name MIT.
• Runtime client config: store identity, brand palette, locale pair, money
  and domains live in StoreSetting and are served on GET /v1/store/config.
  The storefront renders its tokens, locale routing and money formats from
  it at SSR; the admin renders its editors, money inputs and shell identity
  from it. No client branch, no build per client.
• The install stepper: ./setup.sh (Linux, macOS) and ./setup.ps1
  (Windows, local profile) run tools/setup, which asks for every
  store-specific value once, verifies storage, mail, bot protection and the
  optional search-engine integrations live, renders the compose stack, the
  nginx vhosts and the timers from deploy/templates/, builds the images on
  the box, installs the schema, the seeds and the owner account, issues TLS
  and probes the result. Profiles: engine, storefront, both, local.
• Payment providers behind one PaymentProvider interface and registry, with
  cod and manual reference providers and a Stripe example.
• Admin light mode, a semantic token layer, settings screens for identity,
  brand (with a palette preview and contrast report), localization, money
  and domains.
• A brandless tree, guarded by verify:no-client-refs on every push, and
  scenario fixtures (gulf-rtl, maghreb-ltr, demo) every locale, money
  and e2e matrix runs against.
• Deploy templates with no client value, an operator manual at
  deploy/README.md, a generic GitHub Actions pipeline with an install
  smoke job, secret scanning, and npm run release.
• Migration: 20261027120000_drop_license_rows deletes the license:*
RolePermission rows and the license StoreSetting rows left by
  pre-release installs. A setup answers file that still carries a license
  key warns once and the key is ignored.