v1.0.1: card payment at checkout

Card payment at checkout, with Stripe as the first card provider.

• Card checkout. A shopper can pay by card at checkout. Stripe is offered in an embedded Payment Element form or on a hosted Checkout page. Each payment method row picks its checkoutMode.
• Provider agnostic payment action. Placing an order answers with a paymentAction: none, redirect, form_post or embedded. The storefront has one handler for all four, so a new provider needs no storefront change unless it is embedded.
• Payment retry and confirm. POST /v1/orders/:id/payment starts a fresh payment for an unpaid order. POST /v1/orders/:id/payment/confirm asks the provider for the live status when the shopper comes back. Both need X-Idempotency-Key. Webhooks stay the source of truth.
• Credentials in the admin. The operator enters the provider keys on the payment method form. Secret fields are encrypted at rest (AES-256-GCM) with PAYMENT_CONFIG_ENCRYPTION_KEY. Without that key, saving a secret answers PAYMENT_CONFIG_ENCRYPTION_UNAVAILABLE. STRIPE_API_KEY, STRIPE_WEBHOOK_SECRET and STRIPE_PUBLISHABLE_KEY still work as a fallback.
• Several payment methods can be active at once, each with its own keys.
• New stable error codes: CATEGORY_SLUG_TAKEN, CATEGORY_HAS_PRODUCTS, REVIEW_ALREADY_PUBLISHED, QUESTION_ALREADY_PUBLISHED.

More card providers plug in behind one interface. Each one is its own open issue, see the roadmap: https://github.com/Xdabier/themerchantengine/blob/main/ROADMAP.md

Full list: https://github.com/Xdabier/themerchantengine/blob/main/CHANGELOG.md