feat: generate print files, collect delivery addresses, add provider adapters

Week 2 work that did not need client inputs.

Print files (1.4): each paid item gets a PDF the width of the film and the
length of the approved layout, with every copy at its reviewed position,
rotation and mirror. Sources are embedded once at original resolution; JPEG
bytes pass through and PNG alpha becomes a soft mask. Artwork the generator
cannot reproduce goes to hand preparation with the reason. The worker renders
outside any transaction, and the operator approves the generated file as the
final one through the existing review.

Delivery address (3.8): required for any non-pickup quote, bound to the
quoted CEP, carried into the order snapshot, the Kanban card and Tiny.

Kanban (1.5): print-file status per item, and a panel of payment events that
need a person (money without an order, refunds after an order) until an
operator records the resolution.

Mercado Pago and Tiny (1.1, 1.3): adapters written from the public API
documentation and tested against fake transports only. Selectable for
sandbox testing with their credentials; the production preflight still
blocks release. Adds payment intents and a PIX step on the Site.

MinIO: Docker Hub and quay.io now refuse anonymous pulls, so local and CI
storage use Chainguard's MinIO build, pinned by digest.

Verified with the full CI integration sequence on a fresh local build,
including the new print_file_test and both browser suites.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/site-config.js

@@ -75,7 +75,7 @@ let pedido=[];                             // itens já fechados · o pagamento
 // A escolha de entrega vale para o pedido inteiro, não por item. No Tiny, retirada
 // grava forma_envio X, transportador DropStar e frete por conta do remetente — igual
 // ao que a expedição já recebe hoje, sem criar processo novo.
-let entrega={tipo:'retira', cep:'', valor:0, cotado:true};
+let entrega={tipo:'retira', cep:'', valor:0, cotado:true, end:{}};
 let cliente={cnpj:'', zap:'', mail:''};
 let caminho='auto';                        // o que o cliente diz que vai mandar
 
@@ -93,6 +93,19 @@ function cnpjOk(v){
 const zapOk=v=>{ const d=(v||'').replace(/\D/g,''); return d.length===10||d.length===11; };
 const mailOk=v=>/^[^\s@]+@[^\s@]+\.[a-z]{2,}$/i.test((v||'').trim());
 const clienteOk=()=>cnpjOk(cliente.cnpj)&&zapOk(cliente.zap)&&mailOk(cliente.mail);
+// Frete cotado pelo CEP não entrega nada sozinho: a transportadora e o Tiny
+// precisam do endereço completo antes do pagamento.
+const UFS='AC AL AP AM BA CE DF ES GO MA MT MS MG PA PB PR PE PI RJ RN RS RO RR SC SP SE TO'.split(' ');
+const enderecoOk=()=>{
+  if(entrega.tipo!=='frete') return true;
+  const e=entrega.end||{}, t=v=>(v||'').trim();
+  return t(e.nome).length>=2 && t(e.rua).length>=2 && t(e.num).length>=1 &&
+    t(e.bairro).length>=2 && t(e.cidade).length>=2 && UFS.includes(t(e.uf).toUpperCase());
+};
+const destinoApi=()=>entrega.tipo!=='frete' ? null : {
+  recipient:entrega.end.nome.trim(), street:entrega.end.rua.trim(), number:entrega.end.num.trim(),
+  complement:(entrega.end.comp||'').trim(), district:entrega.end.bairro.trim(),
+  city:entrega.end.cidade.trim(), state:entrega.end.uf.trim().toUpperCase(), postal_code:entrega.cep};
 const larguraFilme=()=>MODOS[modo].larg;
 // cobrança proporcional: arredonda para cima em 10 cm · 2,75 m vira 2,80 m
 const cobrar=m=>Math.max(MINIMO_M, Math.ceil(m*10)/10);