feat: offer credit card, debit card and PIX, with the bank's 3-D Secure step

The payment page lists credit card (preselected), debit card and PIX. Each
card option limits Mercado Pago's form to its kind; debit is paid at once.
Card payments ask for 3-D Secure when the issuer requires it, and a
challenge opens the bank's page in a frame, which needs
PAYMENT_CHALLENGE_SOURCES=https: (frames and form posts only). A card left
waiting for that confirmation stops blocking a new attempt after ten
minutes, and a refusal reported by the notification returns the customer to
the payment choice. Written from the documentation; not yet run with a real
debit card.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

compose.local.yaml

@@ -198,6 +198,7 @@ services:
       S3_PUBLIC_ENDPOINT: ${S3_PUBLIC_ENDPOINT:-http://localhost:${STORAGE_PORT:-9000}}
       # Empty unless testing Mercado Pago's card form; see docs/LOCAL_SETUP.md.
       PAYMENT_CSP_SOURCES: ${PAYMENT_CSP_SOURCES:-}
+      PAYMENT_CHALLENGE_SOURCES: ${PAYMENT_CHALLENGE_SOURCES:-}
     ports:
       # Published ports are host-wide even bound to loopback, so on a shared
       # machine any of them can collide with something unrelated. CI overrides
@@ -222,6 +223,7 @@ services:
       WEB_INDEX: kanban.html
       S3_PUBLIC_ENDPOINT: ${S3_PUBLIC_ENDPOINT:-http://localhost:${STORAGE_PORT:-9000}}
       PAYMENT_CSP_SOURCES: ""
+      PAYMENT_CHALLENGE_SOURCES: ""
     ports: ["127.0.0.1:${KANBAN_PORT:-8081}:80"]
     networks: [local, edge]
     depends_on: