feat: offer credit card, debit card and PIX, with the bank's 3-D Secure step

The payment page lists credit card (preselected), debit card and PIX. Each
card option limits Mercado Pago's form to its kind; debit is paid at once.
Card payments ask for 3-D Secure when the issuer requires it, and a
challenge opens the bank's page in a frame, which needs
PAYMENT_CHALLENGE_SOURCES=https: (frames and form posts only). A card left
waiting for that confirmation stops blocking a new attempt after ten
minutes, and a refusal reported by the notification returns the customer to
the payment choice. Written from the documentation; not yet run with a real
debit card.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/LOCAL_SETUP.md

@@ -328,8 +328,14 @@ PAYMENT_CSP_SOURCES=https://sdk.mercadopago.com https://*.mercadopago.com https:
 ```
 
 `PAYMENT_CSP_SOURCES` is empty by default, which keeps the Site at
-`script-src 'self'`. Once a payment for a quote is approved, or a card payment
-is in review, the API refuses any further attempt for that quote. The order is created only by the signed
+`script-src 'self'`. The payment page offers credit card (the default), debit
+card and PIX. Card payments ask for 3-D Secure when the issuer requires it,
+which debit cards usually do: the bank's confirmation page opens in a frame on
+the issuer's own domain, so it needs `PAYMENT_CHALLENGE_SOURCES=https:` (frames
+and form posts only, never scripts; empty by default). Once a payment for a
+quote is approved, or a card payment is in review, the API refuses any further
+attempt for that quote; a card left waiting for the bank's confirmation stops
+blocking after ten minutes. The order is created only by the signed
 notification, after the payment is fetched from the Mercado Pago API and its
 BRL amount matches the approved total. Mercado Pago must be able to reach the
 webhook, so a local run needs a public HTTPS tunnel to the Site port. A paid