feat: support trusted Tabby checkout provider data

[y0u-0]

Summary

• add optional server-resolved providerData to resolveCheckout output
• strictly validate and forward Tabby buyer history, order history, and education attachment
• strip public injection and exclude provider data from callbacks/persistence/responses
• export typed Tabby request contracts from the root and provider entry point

Scope

This is intentionally limited to checkout resolution/types/Tabby request mapping. No Tamara, webhook, refund, recovery, or idempotency behavior changes.

Official contract

• Create a session
• Official OpenAPI

Verification

• pnpm check
• 24 test files, 285 tests passed
• lint, typecheck, ESM/CJS build, and declarations passed
• packed ESM/CJS/TypeScript consumers passed
• git diff --check

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/better-auth-bnpl@9

commit: d3a46f3