feat: add Stripe checkout, order persistence, and webhook handling

Stripe-hosted Checkout integration with full order lifecycle:
- stripity_stripe ~> 3.2 with sandbox/prod config via env vars
- Order and OrderItem schemas with price snapshots at purchase time
- CheckoutController creates pending order then redirects to Stripe
- StripeWebhookController verifies signatures and confirms payment
- Success page with real-time PubSub updates from webhook
- Shop flash messages for checkout error feedback
- Cart cleared after successful payment

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

README.md

@@ -10,6 +10,7 @@ A complete storefront with all the pages you need:
 - **Products** - Grid layout with hover effects and filtering
 - **Product Detail** - Image gallery, variants, reviews, related products
 - **Cart** - Full shopping cart with order summary
+- **Checkout** - Stripe-hosted checkout with order confirmation
 - **About** - Rich content with your brand story
 - **Contact** - Contact form with business details
 - **Error pages** - Themed 404/500 pages
@@ -110,12 +111,50 @@ assets/css/
 | `/collections/:slug` | Category collection (filterable) |
 | `/products/:id` | Product detail page |
 | `/cart` | Shopping cart |
+| `/checkout` | Create Stripe session (POST) |
+| `/checkout/success` | Order confirmation |
+| `/webhooks/stripe` | Stripe webhook endpoint |
 | `/about` | About page |
 | `/contact` | Contact page |
 | `/admin/theme` | Theme editor (requires auth) |
 | `/dev/errors/404` | Preview 404 page (dev only) |
 | `/dev/errors/500` | Preview 500 page (dev only) |
 
+## Stripe Checkout
+
+SimpleShop uses [Stripe Checkout](https://stripe.com/docs/payments/checkout) (hosted payment page) for secure payment processing.
+
+### Setup
+
+1. Create a [Stripe account](https://dashboard.stripe.com/register)
+2. Get your API keys from the [Stripe Dashboard](https://dashboard.stripe.com/test/apikeys)
+3. Set environment variables:
+
+```bash
+export STRIPE_SECRET_KEY="sk_test_..."
+export STRIPE_WEBHOOK_SECRET="whsec_..."
+```
+
+### Local webhook testing
+
+Use the [Stripe CLI](https://stripe.com/docs/stripe-cli) to forward webhooks to your local server:
+
+```bash
+stripe listen --forward-to localhost:4000/webhooks/stripe
+```
+
+The CLI will print a webhook signing secret — use that as `STRIPE_WEBHOOK_SECRET`.
+
+### Test cards
+
+| Number | Result |
+|--------|--------|
+| `4242 4242 4242 4242` | Successful payment |
+| `4000 0000 0000 0002` | Declined |
+| `4000 0025 0000 3155` | Requires 3D Secure |
+
+Use any future expiry date and any 3-digit CVC.
+
 ## Generating Mockups
 
 The project includes a Printify integration for generating product mockups. This is useful for creating sample product images from Unsplash artwork.