fix: ask 3-D Secure of debit cards only, and send the cardholder as the card payer

A credit card payment with the test credentials was refused with 10113
("the payment method is excluded by a rule"). Every card was sent with
three_d_secure_mode, which only debit needs, and with the order's CNPJ as
payer instead of the cardholder's document from the card form. Debit
methods keep 3-D Secure, and the card form's document is the payer.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/core/models.py

@@ -192,6 +192,10 @@ class PaymentMethod(StrictModel):
     payment_method_id: str | None = Field(default=None, max_length=40, pattern=r'^[a-z_]+$')
     installments: int = Field(default=1, ge=1, le=12, strict=True)
     issuer_id: str | None = Field(default=None, max_length=40)
+    # The cardholder's document from the card form: for a card, the payer is
+    # the cardholder, not necessarily the company on the invoice.
+    payer_document_type: Literal['CPF', 'CNPJ'] | None = None
+    payer_document: str | None = Field(default=None, pattern=r'^[0-9]{11,14}$')
 
     @model_validator(mode='after')
     def card_needs_token(self):