feat: generate print files, collect delivery addresses, add provider adapters

Week 2 work that did not need client inputs.

Print files (1.4): each paid item gets a PDF the width of the film and the
length of the approved layout, with every copy at its reviewed position,
rotation and mirror. Sources are embedded once at original resolution; JPEG
bytes pass through and PNG alpha becomes a soft mask. Artwork the generator
cannot reproduce goes to hand preparation with the reason. The worker renders
outside any transaction, and the operator approves the generated file as the
final one through the existing review.

Delivery address (3.8): required for any non-pickup quote, bound to the
quoted CEP, carried into the order snapshot, the Kanban card and Tiny.

Kanban (1.5): print-file status per item, and a panel of payment events that
need a person (money without an order, refunds after an order) until an
operator records the resolution.

Mercado Pago and Tiny (1.1, 1.3): adapters written from the public API
documentation and tested against fake transports only. Selectable for
sandbox testing with their credentials; the production preflight still
blocks release. Adds payment intents and a PIX step on the Site.

MinIO: Docker Hub and quay.io now refuse anonymous pulls, so local and CI
storage use Chainguard's MinIO build, pinned by digest.

Verified with the full CI integration sequence on a fresh local build,
including the new print_file_test and both browser suites.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/adapters.py

@@ -17,9 +17,24 @@ def require_runtime():
     checkout until their audited implementations are added.
     """
     environment = os.environ.get('APP_ENV', 'local')
-    for name in ('PAYMENT', 'FREIGHT', 'TINY', 'WHATSAPP'):
+    for name in ('FREIGHT', 'WHATSAPP'):
         if os.environ.get(f'{name}_ADAPTER') != 'fake':
             raise RuntimeError(f'{name} must use the currently supported fake adapter')
+    tiny = os.environ.get('TINY_ADAPTER')
+    if tiny == 'tiny':
+        if not os.environ.get('TINY_TOKEN'):
+            raise RuntimeError('TINY_TOKEN is required for the Tiny adapter')
+    elif tiny != 'fake':
+        raise RuntimeError('TINY must use the fake or tiny adapter')
+    # Mercado Pago is selectable only with its credentials present; it has not
+    # yet passed the sandbox flows, so production preflight still blocks it.
+    payment = os.environ.get('PAYMENT_ADAPTER')
+    if payment == 'mercadopago':
+        for name in ('MP_ACCESS_TOKEN', 'MP_WEBHOOK_SECRET'):
+            if not os.environ.get(name):
+                raise RuntimeError(f'{name} is required for the Mercado Pago adapter')
+    elif payment != 'fake':
+        raise RuntimeError('PAYMENT must use the fake or mercadopago adapter')
     if environment == 'local':
         if os.environ.get('STORAGE_ADAPTER') != 's3-local':
             raise RuntimeError('Local runtime requires local S3 storage')
@@ -60,14 +75,14 @@ class PaymentEvent(NamedTuple):
 
 
 class PaymentAdapter(Protocol):
-    def create(self, quote_id: str, total_cents: int, customer: dict) -> dict:
+    def create(self, quote_id: str, total_cents: int, customer: dict, method: dict | None = None) -> dict:
         """Start a payment. Must be idempotent on quote_id: a retry after a
         timeout has to return the existing payment, never charge twice."""
 
-    def verify(self, headers: Mapping[str, str], body: bytes) -> bool:
+    def verify(self, headers: Mapping[str, str], body: bytes, query: Mapping[str, str] | None = None) -> bool:
         """Whether this delivery genuinely came from the provider."""
 
-    def parse(self, body: bytes) -> PaymentEvent | None:
+    def parse(self, body: bytes, query: Mapping[str, str] | None = None) -> PaymentEvent | None:
         """Normalise a verified delivery, or None if it is not about a payment."""
 
 
@@ -80,13 +95,14 @@ class FakePayment:
     the service changes.
     """
 
+    name = 'fake'
     header = 'x-payment-signature'
 
     def _secret(self) -> bytes | None:
         secret = os.environ.get('PAYMENT_WEBHOOK_SECRET', '')
         return secret.encode() if secret else None
 
-    def create(self, quote_id: str, total_cents: int, customer: dict) -> dict:
+    def create(self, quote_id: str, total_cents: int, customer: dict, method: dict | None = None) -> dict:
         return {'provider': 'fake', 'id': f'local-{quote_id}',
                 'status': 'pending', 'total_cents': total_cents}
 
@@ -96,7 +112,7 @@ class FakePayment:
             raise RuntimeError('PAYMENT_WEBHOOK_SECRET is not configured')
         return hmac.new(secret, body, hashlib.sha256).hexdigest()
 
-    def verify(self, headers, body: bytes) -> bool:
+    def verify(self, headers, body: bytes, query=None) -> bool:
         # No configured secret means nothing can be verified, so nothing is
         # accepted. A guessable default would let anyone forge an approval and
         # create an order that was never paid for.
@@ -105,7 +121,7 @@ class FakePayment:
         supplied = headers.get(self.header) or headers.get(self.header.title()) or ''
         return hmac.compare_digest(supplied, self.sign(body))
 
-    def parse(self, body: bytes):
+    def parse(self, body: bytes, query=None):
         try:
             data = json.loads(body)
         except ValueError:
@@ -158,6 +174,8 @@ class ObjectStorage(Protocol):
     def complete(self, key: str, upload_id: str, parts: list): ...
     def size(self, key: str) -> int: ...
     def download(self, key: str, name: str) -> str: ...
+    def fetch(self, key: str, path: str): ...
+    def store(self, key: str, path: str, content_type: str): ...
     def health(self): ...
     def discard(self, key: str, upload_id: str, complete: bool): ...
 
@@ -206,6 +224,14 @@ class LocalS3Storage:
     def size(self, key):
         return self.client.head_object(Bucket=self.bucket, Key=key)['ContentLength']
 
+    def fetch(self, key, path):
+        """Copy a stored object to a local file (the worker's scratch space)."""
+        self.client.download_file(self.bucket, key, path)
+
+    def store(self, key, path, content_type):
+        """Upload a file the service generated itself, such as a print file."""
+        self.client.upload_file(path, self.bucket, key, ExtraArgs={'ContentType': content_type})
+
     def download(self, key, name):
         from urllib.parse import quote
         return self.public.generate_presigned_url('get_object', Params={