Route storefront checkout to a local stub outside production

The checkout form and payment-method lookup were hardcoded to the live
payment router, so any local LMS (next dev included) created real
orders: a stray test click on 20261111 produced order 1794380127.

- resolvePayBase(): NEXT_PUBLIC_PAY_BASE_URL if set, otherwise the live
  router for production builds and /dev/pay-stub for everything else.
- /dev/pay-stub/pay/{methods,order}: dev-only stand-ins (404 in
  production) that make no outbound calls and store nothing.
- Document in CLAUDE.md that a local `next build && next start` still
  hits the live router unless NEXT_PUBLIC_PAY_BASE_URL is set.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/app/dev/pay-stub/pay/order/route.ts

@@ -0,0 +1,28 @@
+import { NextRequest, NextResponse } from "next/server";
+
+// Local stand-in for payment-router POST /pay/order (see src/lib/pay-base.ts).
+// Echoes the submitted fields back as a page. Stores nothing, sends nothing.
+// Production: 404.
+
+function escapeHtml(s: string) {
+  return s.replace(/[&<>"']/g, (c) =>
+    ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c] as string,
+  );
+}
+
+export async function POST(request: NextRequest) {
+  if (process.env.NODE_ENV === "production") {
+    return new NextResponse(null, { status: 404 });
+  }
+  const form = await request.formData();
+  const rows = [...form.entries()]
+    .map(([k, v]) => `<tr><td>${escapeHtml(k)}</td><td>${escapeHtml(typeof v === "string" ? v : "[файл]")}</td></tr>`)
+    .join("");
+  const html = `<!doctype html><meta charset="utf-8"><title>Заглушка оплаты</title>
+<body style="font-family:'Fira Mono',ui-monospace,monospace;background:#F5F5F0;color:#323232;padding:24px">
+<h1 style="font-size:20px">Заглушка оплаты (dev)</h1>
+<p>Заказ не создан, данные никуда не отправлены. Так выглядела бы отправка на payment-router:</p>
+<table style="border:2px solid #323232;border-collapse:collapse" cellpadding="6">${rows}</table>
+<p><a href="/dashboard">← На дашборд</a></p></body>`;
+  return new NextResponse(html, { headers: { "Content-Type": "text/html; charset=utf-8" } });
+}