payment tests

deploy/README.md

@@ -387,6 +387,48 @@ Mechanics worth knowing:
 * VAT is unchanged by payment method: the sale is priced and invoiced in euro
   and taxed on the euro value, whichever rail settled it.
 
+### Live payment suites in CI
+
+Every deploy runs both rails against their real counterparts, as a mandatory
+gate — a push that cannot create a Mollie test payment or settle a real EURC
+transfer on Ethereum Sepolia does not ship. That is a deliberate
+caution-over-convenience trade: a public RPC hiccup can fail a deploy (re-run
+the workflow), but the rail code can never drift from the live providers
+unnoticed. The suites are `ShouldCreateMollieTestPayments` (create + poll on a
+test-mode key; Mollie has no API to mark a test payment paid, so the paid flip
+stays with the fake-rail suite and the pre-launch click-through) and
+`ShouldSettleEurcOnTestnet` (a €1 donation paid with 1 real testnet EURC,
+settled by the same two-endpoint quorum as mainnet). Locally both skip unless
+their variable is exported; in CI a missing secret is a failure, checked as
+the workflow's first step.
+
+Two Forgejo secrets feed them (repo → Settings → Actions → Secrets):
+
+* `MOLLIE_TEST_API_KEY` — the `test_` key from the Mollie dashboard
+  (Developers → API keys). The suite refuses anything not starting `test_`,
+  so the live key can never be pasted in by mistake without the gate saying so.
+* `EURC_E2E_PRIVATE_KEY` — a throwaway Ethereum Sepolia key
+  (`cast wallet new`), used ONLY for this: it holds worthless testnet tokens,
+  never mainnet funds. Fund it with testnet EURC at
+  <https://faucet.circle.com> — **network set to Ethereum Sepolia**, one claim
+  is ~20 EURC — and Sepolia ETH for gas from the pk910 PoW faucet
+  (<https://sepolia-faucet.pk910.de>, no account, it mines in a browser tab;
+  one ~0.05 ETH claim covers hundreds of transfers). **Each deploy spends
+  1 EURC plus gas**, and the suite's receiving addresses are random — the
+  EURC is gone after the run. When the wallet runs dry the EURC suite fails
+  at `cast send` with the faucet pointers in its output; top up and re-run.
+
+The workflow installs Foundry's `cast` for the transfer — the server itself
+cannot sign transactions, by design. The EURC suite watches `block_tag:
+"latest"` (not production's `finalized`) because Sepolia finality is ~13
+minutes; the rail's reorg warning in that suite's server log is expected. To
+prove the funded wallet end-to-end before it gates a deploy, run the suite
+live once from a dev shell:
+
+```sh
+EURC_E2E_PRIVATE_KEY=0x... crafter-build test ShouldSettleEurcOnTestnet --product=server
+```
+
 ## Shipping rates: Sendcloud (REQUIRED to sell)
 
 Sendcloud is the only source of shipping prices. There is no compiled-in