Route storefront checkout to a local stub outside production

The checkout form and payment-method lookup were hardcoded to the live
payment router, so any local LMS (next dev included) created real
orders: a stray test click on 20261111 produced order 1794380127.

- resolvePayBase(): NEXT_PUBLIC_PAY_BASE_URL if set, otherwise the live
  router for production builds and /dev/pay-stub for everything else.
- /dev/pay-stub/pay/{methods,order}: dev-only stand-ins (404 in
  production) that make no outbound calls and store nothing.
- Document in CLAUDE.md that a local `next build && next start` still
  hits the live router unless NEXT_PUBLIC_PAY_BASE_URL is set.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.env.example

@@ -21,6 +21,12 @@ TURNSTILE_SECRET_KEY=""
 # (ym init snippet) ставится в admin → Settings → headCode, отдельно от этого ID.
 NEXT_PUBLIC_METRIKA_COUNTER_ID=""
 
+# Адрес payment-router для чекаута витрины (/pay/order, /pay/methods). Build-time.
+# Пусто: dev → локальная заглушка /dev/pay-stub, production-сборка → боевой
+# https://obsidian.second-brain.ru. Для локальной `next build && next start`
+# задать явно (например http://localhost:9), иначе форма уйдёт на прод.
+NEXT_PUBLIC_PAY_BASE_URL=""
+
 # Kinescope API
 KINESCOPE_API_KEY=""