feat: place PDF artwork in print files, add card payment, count only failed logins

PDF artwork: a single-page PDF source is placed in the print file as a
vector form through pikepdf, never rasterised, using the CropBox and
inherited /Rotate the Site measured with pdf.js. Multi-page and protected
PDFs go to hand preparation. PyMuPDF was not used because of its AGPL
licence. Raster tests cover crop, page rotation, placement rotation and
mirroring, and fail when the rotation or crop handling is broken.

Card payment: Mercado Pago's Card Payment Brick on the Site when
MP_PUBLIC_KEY is set; the card becomes a one-time token in Mercado Pago's
secure fields. Each card attempt has its own idempotency key, and the intent
route refuses new attempts once a payment is approved or a card is in
review, so a quote cannot be charged twice. The Site CSP admits Mercado
Pago's origins only through PAYMENT_CSP_SOURCES, empty by default.

Logins: every attempt counts against the source address, only failures
against the account. Counting successful sign-ins let ordinary use lock an
operator out and made CI's final browser sign-in fail.

No new required settings; production behaviour is unchanged until the
provider credentials are configured. Verified with the full CI integration
sequence locally.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/LOCAL_SETUP.md

@@ -231,7 +231,10 @@ shows the status per item, the page size and the lowest DPI, and offers
 **Baixar PDF**. In **Arquivos de produção** the generated file is preselected
 as the final file; untick it to upload one by hand instead.
 
-Only JPEG, PNG, WebP and TIFF are generated. PDF, PSD, AI and CDR artwork, a
+JPEG, PNG, WebP and TIFF are embedded as images. A single-page PDF is placed
+as a vector form (never rasterised), using the page's CropBox and `/Rotate`
+exactly as the Site measured it with pdf.js; the card then shows **PDF
+vetorial**. PSD, AI and CDR artwork, multi-page or password-protected PDFs, a
 file whose proportions do not match the quoted size, a layout longer than was
 billed, or an image above `PRINT_MAX_PIXELS` (250 Mpx by default) goes to
 **preparar à mão** with the reason, and the operator prepares it as before.
@@ -304,14 +307,25 @@ agree the test with the client and cancel the test orders afterwards.
 with a fake token server; it saves and restores any existing connection.
 
 With Mercado Pago selected, an approved quote shows **Pagar com PIX** on the
-Site instead of the local test button. The order is created only by the signed
+Site instead of the local test button, and **Pagar com cartão** when
+`MP_PUBLIC_KEY` is set. The card form is Mercado Pago's Card Payment Brick: the
+card is typed into Mercado Pago's secure fields and only a one-time token
+reaches the API. It loads from Mercado Pago, so the Site's CSP must allow it:
+
+```bash
+MP_PUBLIC_KEY=TEST-...
+PAYMENT_CSP_SOURCES=https://sdk.mercadopago.com https://*.mercadopago.com https://*.mlstatic.com https://*.mercadolibre.com
+```
+
+`PAYMENT_CSP_SOURCES` is empty by default, which keeps the Site at
+`script-src 'self'`. Once a payment for a quote is approved, or a card payment
+is in review, the API refuses any further attempt for that quote. The order is created only by the signed
 notification, after the payment is fetched from the Mercado Pago API and its
 BRL amount matches the approved total. Mercado Pago must be able to reach the
 webhook, so a local run needs a public HTTPS tunnel to the Site port. A paid
 notification that cannot become an order, or a refund on an existing order,
 appears under **Pagamentos que precisam de atenção** on the Kanban until an
-operator records the resolution. Card payment needs the Mercado Pago public key
-and its card form on the Site; that part is not built yet.
+operator records the resolution.
 
 ## Local backup and restore check