Implement Stripe payment intents

[yang-agoni]

/claim #1

Summary

Implements the Stripe PaymentIntent flow for the payment service.

• Replaces the mock pay_${Date.now()} payment id with Stripe's Node SDK.
• Reads the Stripe secret key from STRIPE_SECRET_KEY.
• Validates payment payloads before contacting Stripe.
• Defaults currency to usd and normalizes explicit three-letter currency codes.
• Supports Stripe metadata after filtering nullish values and converting values to strings.
• Returns the Stripe paymentId, clientSecret, amount, currency, and provider.
• Maps validation, configuration, and Stripe provider failures to useful API responses.

Verification

• npm test -w apps/api
• git diff --check

Demo

• Short demo video: https://github.com/yang-agoni/bug-bounty/releases/download/pr20-demo-20260517/securebanana-pr20-demo.mp4

The real Stripe smoke test is included but intentionally skipped by default. It runs only with:

STRIPE_SMOKE_TEST=1 STRIPE_SECRET_KEY=sk_test_... npm test -w apps/api

Notes

The smoke test should be run only with a Stripe test-mode key. No secret key is committed.

Closes #1