feat: generate print files, collect delivery addresses, add provider adapters

Week 2 work that did not need client inputs.

Print files (1.4): each paid item gets a PDF the width of the film and the
length of the approved layout, with every copy at its reviewed position,
rotation and mirror. Sources are embedded once at original resolution; JPEG
bytes pass through and PNG alpha becomes a soft mask. Artwork the generator
cannot reproduce goes to hand preparation with the reason. The worker renders
outside any transaction, and the operator approves the generated file as the
final one through the existing review.

Delivery address (3.8): required for any non-pickup quote, bound to the
quoted CEP, carried into the order snapshot, the Kanban card and Tiny.

Kanban (1.5): print-file status per item, and a panel of payment events that
need a person (money without an order, refunds after an order) until an
operator records the resolution.

Mercado Pago and Tiny (1.1, 1.3): adapters written from the public API
documentation and tested against fake transports only. Selectable for
sandbox testing with their credentials; the production preflight still
blocks release. Adds payment intents and a PIX step on the Site.

MinIO: Docker Hub and quay.io now refuse anonymous pulls, so local and CI
storage use Chainguard's MinIO build, pinned by digest.

Verified with the full CI integration sequence on a fresh local build,
including the new print_file_test and both browser suites.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/worker.py

@@ -1,6 +1,7 @@
 """Transactional outbox worker. Fake receipts persist; no messages leave the stack."""
 import json
 import logging
+import os
 import threading
 import time
 from http.server import BaseHTTPRequestHandler, HTTPServer
@@ -8,15 +9,21 @@ from psycopg.types.json import Jsonb
 from .adapters import FakeTiny, FakeWhatsApp, LocalS3Storage, require_runtime
 from .core.secrets import load as load_secret_files
 from .core.db import connect
+from .printjobs import render_loop
 from .scanning import ClamAV, scan_loop
 
 load_secret_files()
 require_runtime()
 adapters = {'tiny': FakeTiny(), 'whatsapp': FakeWhatsApp()}
+# Not yet confirmed against the client's account; see app/tiny.py.
+if os.environ.get('TINY_ADAPTER') == 'tiny':
+    from .tiny import TinyOrders
+    adapters['tiny'] = TinyOrders()
 last_tick = 0.0
 last_cleanup = 0.0
 storage = LocalS3Storage()
 scan_thread = None
+render_thread = None
 
 def cleanup():
     """Delete only expired object bytes; retain order/file metadata and history."""
@@ -64,16 +71,20 @@ class Health(BaseHTTPRequestHandler):
             scanner = bool(scan_thread and scan_thread.is_alive() and ClamAV().ping())
         except Exception:
             pass
-        healthy = time.monotonic()-last_tick < 15 and scanner
+        renderer = bool(render_thread and render_thread.is_alive())
+        healthy = time.monotonic()-last_tick < 15 and scanner and renderer
         self.send_response(200 if self.path == '/health' and healthy else 503)
         self.end_headers()
         self.wfile.write(json.dumps({'worker': 'ok' if healthy else 'unavailable',
-                                     'scanner': 'ok' if scanner else 'unavailable'}).encode())
+                                     'scanner': 'ok' if scanner else 'unavailable',
+                                     'print_files': 'ok' if renderer else 'unavailable'}).encode())
     def log_message(self, *args):
         pass
 
 if __name__ == '__main__':
     scan_thread = threading.Thread(target=scan_loop,args=(storage,),daemon=True)
     scan_thread.start()
+    render_thread = threading.Thread(target=render_loop,args=(storage,),daemon=True)
+    render_thread.start()
     threading.Thread(target=loop, daemon=True).start()
     HTTPServer(('0.0.0.0',8002),Health).serve_forever()