Route storefront checkout to a local stub outside production

The checkout form and payment-method lookup were hardcoded to the live
payment router, so any local LMS (next dev included) created real
orders: a stray test click on 20261111 produced order 1794380127.

- resolvePayBase(): NEXT_PUBLIC_PAY_BASE_URL if set, otherwise the live
  router for production builds and /dev/pay-stub for everything else.
- /dev/pay-stub/pay/{methods,order}: dev-only stand-ins (404 in
  production) that make no outbound calls and store nothing.
- Document in CLAUDE.md that a local `next build && next start` still
  hits the live router unless NEXT_PUBLIC_PAY_BASE_URL is set.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/lib/__tests__/pay-base.test.ts

@@ -0,0 +1,20 @@
+import { describe, it, expect } from "vitest";
+import { DEV_PAY_STUB_BASE, LIVE_PAY_BASE, resolvePayBase } from "../pay-base";
+
+describe("resolvePayBase", () => {
+  it("dev без переменной — локальная заглушка", () => {
+    expect(resolvePayBase({ nodeEnv: "development" })).toBe(DEV_PAY_STUB_BASE);
+    expect(resolvePayBase({ nodeEnv: "test" })).toBe(DEV_PAY_STUB_BASE);
+    expect(resolvePayBase({})).toBe(DEV_PAY_STUB_BASE);
+  });
+
+  it("production без переменной — боевой роутер", () => {
+    expect(resolvePayBase({ nodeEnv: "production" })).toBe(LIVE_PAY_BASE);
+    expect(resolvePayBase({ nodeEnv: "production", payBaseUrl: "  " })).toBe(LIVE_PAY_BASE);
+  });
+
+  it("явная переменная побеждает в любом режиме", () => {
+    expect(resolvePayBase({ nodeEnv: "production", payBaseUrl: "http://localhost:9" })).toBe("http://localhost:9");
+    expect(resolvePayBase({ nodeEnv: "development", payBaseUrl: "https://pay.example/" })).toBe("https://pay.example");
+  });
+});