feat: offer credit card, debit card and PIX, with the bank's 3-D Secure step

The payment page lists credit card (preselected), debit card and PIX. Each
card option limits Mercado Pago's form to its kind; debit is paid at once.
Card payments ask for 3-D Secure when the issuer requires it, and a
challenge opens the bank's page in a frame, which needs
PAYMENT_CHALLENGE_SOURCES=https: (frames and form posts only). A card left
waiting for that confirmation stops blocking a new attempt after ten
minutes, and a refusal reported by the notification returns the customer to
the payment choice. Written from the documentation; not yet run with a real
debit card.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docker-compose.yml

@@ -175,6 +175,10 @@ services:
       # Mercado Pago's card form loads from these origins; empty keeps the
       # Site at script-src 'self'. Set together with the Mercado Pago adapter.
       PAYMENT_CSP_SOURCES: ${PAYMENT_CSP_SOURCES:-}
+      # The bank's confirmation page for debit and other 3-D Secure cards is
+      # on the issuer's own domain, so it cannot be listed: "https:" lets
+      # frames and form posts reach it (never scripts). Empty turns it off.
+      PAYMENT_CHALLENGE_SOURCES: ${PAYMENT_CHALLENGE_SOURCES:-}
     networks: [backend]
     ports:
       - target: 8080
@@ -198,6 +202,7 @@ services:
       PUBLIC_HOST: ${KANBAN_DOMAIN:?set KANBAN_DOMAIN}
       S3_PUBLIC_ENDPOINT: ${R2_ENDPOINT:?set R2_ENDPOINT}
       PAYMENT_CSP_SOURCES: ""
+      PAYMENT_CHALLENGE_SOURCES: ""
     networks: [backend]
     ports:
       - target: 8080