Payments

Today: demo screens (/{l}/checkout/{code}, apps/web/src/pages/Checkout.tsx) — card / PayPal / Apple & Google Pay / bank transfer, processing, success and declined (?demo=fail) states.

Safety: card fields are read-only with Stripe's public test number, so no one can type a real card into a page that does not process it; "paying" changes nothing on the server — the order stays awaiting_payment.

Later: Stripe Checkout — already coded (workers/api/src/modules/payments/). Set STRIPE_SECRET_KEY and STRIPE_WEBHOOK_SECRET (roadmap OPS-05) and the API returns a checkoutUrl; customers then go straight to Stripe and never see the demo screens. Webhook: https://api.artlove365.com/v1/payments/stripe-webhook (checkout.session.completed).