feat: offer credit card, debit card and PIX, with the bank's 3-D Secure step

The payment page lists credit card (preselected), debit card and PIX. Each
card option limits Mercado Pago's form to its kind; debit is paid at once.
Card payments ask for 3-D Secure when the issuer requires it, and a
challenge opens the bank's page in a frame, which needs
PAYMENT_CHALLENGE_SOURCES=https: (frames and form posts only). A card left
waiting for that confirmation stops blocking a new attempt after ten
minutes, and a refusal reported by the notification returns the customer to
the payment choice. Written from the documentation; not yet run with a real
debit card.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_mercadopago.py

@@ -129,6 +129,20 @@ class MercadoPagoTests(unittest.TestCase):
                        {'type': 'card', 'token': 'tok_def', 'payment_method_id': 'visa'})
         self.assertNotEqual(self.requests[-1].headers['x-idempotency-key'], first_key)
         self.assertTrue(first_key.startswith('dtf-quote-q-card-'))
+        self.assertEqual(body['three_d_secure_mode'], 'optional')
+        self.assertIsNone(self.mp.create('q', 1000, {'mail': 'a@example.test', 'cnpj': '11222333000181'},
+                                         {'type': 'card', 'token': 'tok_ghi', 'payment_method_id': 'visa'})['challenge'])
+
+    def test_a_card_the_bank_must_confirm_returns_its_challenge(self):
+        def handler(request):
+            return httpx.Response(201, json={'id': 777, 'status': 'pending', 'status_detail': 'pending_challenge',
+                                             'three_ds_info': {'external_resource_url': 'https://acs.bank.example/challenge',
+                                                               'creq': 'eyJjcmVxIjoiMSJ9'}})
+        mp = MercadoPagoPayment('TEST-token', SECRET, transport=httpx.MockTransport(handler), clock=lambda: NOW)
+        created = mp.create('q', 1000, {'mail': 'a@example.test', 'cnpj': '11222333000181'},
+                            {'type': 'card', 'token': 'tok_debit', 'payment_method_id': 'debvisa'})
+        self.assertEqual((created['status'], created['status_detail']), ('pending', 'pending_challenge'))
+        self.assertEqual(created['challenge'], {'url': 'https://acs.bank.example/challenge', 'creq': 'eyJjcmVxIjoiMSJ9'})
 
 
 if __name__ == '__main__':