[Plugin] Wire the Stripe payment gateway into the in-process commerce client

[urumi-fde]

Summary

• Every card checkout on the current deployment fails: make-commerce-client.ts wires x402 into InProcessCommerceClient's payment gateways but never wires stripe, which is the only payment method the storefront checkout actually requests (checkout-routes.ts's hardcoded PAYMENT_METHOD constant). createOrderFromCart resolves an empty gateway slot and throws before it can return a typed reason, so the failure surfaces as an opaque RENDER_FAILED rather than a real PaymentIntent or a clean "not configured" message.
• Added packages/plugin/src/payments/stripe-wiring.ts, mirroring the existing x402-wiring.ts pattern, using the already-built @otta-sh/payments-stripe adapter — webhooks/stripe-settle-route.ts already constructs a StripePaymentGateway to verify inbound webhooks; nothing ever constructed one to create a PaymentIntent for createOrder.
• Fail-closed on both settings:stripeSecretKey and settings:stripeWebhookSecret together, even though only the secret key is strictly needed to create an intent: a gateway that can take a buyer's live payment but whose confirmation nothing can ever verify (or the reverse) is a half-armed state worse than off, matching the "both configured or no gateway" posture x402GatewayFromCtx already uses.
• No allowedHosts change needed — api.stripe.com is the one constant resolveAllowedHosts always grants regardless of deployment config.

Test plan

• pnpm lint — clean
• pnpm typecheck — clean
• New stripe-wiring.test.ts — 6 cases (both-required fail-closed, kv-rejection degrades safely, live createIntent call routed through ctx.http.fetch rather than global fetch)
• Updated make-commerce-client.test.ts — its "reads no credential from kv" assumption no longer holds (Stripe has no build-time gate the way x402's facilitator URL does), corrected to assert exactly the two Stripe keys are read and nothing else
• pnpm vitest run packages/plugin packages/payments-stripe — 69 files, 1252 passed, 0 failed
• pnpm --filter @otta-sh/plugin build — clean
• Post-merge: rebuild+redeploy with a real Stripe test publishable key baked in and test-mode credentials provisioned in admin Settings, then drive a real checkout end-to-end

🤖 Generated with Claude Code

https://claude.ai/code/session_01HPywdmMJ9B4V1ME6GrxuDu