Atelier: Stripe Connect for agency client payments (replace pasted keys) + live card test

Imported from GitHub issue El-SaMa/oma#136 by @El-SaMa.

---

Why

Agencies (Atelier resellers) take card payments from their own clients into their own Stripe account, so the card statement shows the agency, not Lanetti. Today they paste a secret key and a webhook signing secret into Settings (oma.reseller.manage_payments). That works but is clumsy and puts API keys in agencies' hands. It has also never been tested end to end with real (test-mode) keys.

Do not switch to Lanetti collecting and paying out (merchant of record): the descriptor would read Lanetti, which breaks white label, and collecting on someone else's behalf can count as a regulated payment service in the EU. Kustom/Klarna is not an option for agency clients (each agency would need its own merchant agreement).

What

1. Enable Stripe Connect on Lanetti's Stripe account (operator task; needs a Lanetti Stripe account).
2. Replace the paste-keys form with "Connect Stripe" (Standard connected accounts, OAuth or Account Links). Store the connected account id, not secret keys.
3. Create Checkout Sessions on the connected account (Stripe-Account header) so the descriptor and payout stay the agency's. Optional application_fee_amount as a platform fee (decide with the operator).
4. One platform webhook endpoint for connected accounts (checkout.session.completed); keep the existing guards: exact amount and currency match, idempotent mark-paid, emits reseller.invoice.paid.
5. Migration path: agencies that pasted keys keep working until they reconnect; then clear the stored ciphertexts.
6. End to end test in Stripe test mode: QA agency, QA client invoice, pay by card, invoice marked paid, webhook delivered.

Where

• services/core-api/src/reseller/stripe.ts, tool oma.reseller.manage_payments (registry, MCP schema, confirm)
• apps/web/lib/reseller/client-pay.ts, apps/web/app/api/webhooks/agency-stripe/[resellerOrgId]/route.ts
• apps/web/components/reseller/payments-panel.tsx, pay-invoice-button.tsx
• Handbook apps/web/content/admin-docs/products/reseller.md (card payments section); terms /legal/reseller section 5 already covers it.

Done when

Connect onboarding works from the agency console, a test-mode card payment marks an agency invoice paid, the statement descriptor is the agency's, no secret keys are stored, tests and handbook updated.