Payments: switch on Stripe in OMA checkout with all relevant methods (cards, Apple/Google Pay, MobilePay, SEPA, saved cards)

Imported from GitHub issue El-SaMa/oma#143 by @El-SaMa.

---

Current state

• services/core-api/src/payments/gateways.ts already has a StripeGateway (Stripe Checkout Session, checkout/sessions), plus apps/web/lib/billing/stripe-vault.ts for saved payment methods.
• It is not active: there is no Lanetti Stripe account / keys yet (operator task). Kustom (Klarna) and bank transfer are live today.
• The session does not pass payment_method_types, so Stripe Checkout uses the methods switched on in the Stripe Dashboard (dynamic payment methods). Good: methods can be turned on without code.

What

1. Operator: create the Lanetti Stripe account (Maximum Effort Ay), set the statement descriptor (e.g. LANETTI), and set the keys in OMA (Admin, Integrations, Stripe; env var names only, never in chat or commits).
2. Payment methods to switch on in the Dashboard and verify in checkout (EUR, Finnish customers first):
   • Cards (Visa, Mastercard, Amex)
   • Apple Pay and Google Pay (domain verification for oma.lanetti.fi and the public site)
   • MobilePay (Stripe supports it for Finland and Denmark in EUR/DKK; check eligibility on the account)
   • Link
   • SEPA Direct Debit for recurring hosting renewals (slower settlement; handle processing state)
   • Revolut Pay, and Klarna via Stripe only if the operator wants it alongside Kustom (avoid two Klarna buttons)
   • Note: Finnish online-bank buttons (Nordea, OP and so on) are not a Stripe method; keep Kustom (or Paytrail, if wanted later) for those.
3. Saved cards / auto-renew: finish the stripe-vault flow (SetupIntent at checkout, off-session PaymentIntent at renewal, SCA handling with an email link when authentication is required).
4. Webhooks: checkout.session.completed, payment_intent.succeeded/payment_failed, charge.refunded, charge.dispute.created. Idempotent mark-paid, exact amount/currency checks (same pattern as settleResellerInvoiceFromStripe).
5. Refunds from the admin invoice page through Stripe, recorded as refunds on the invoice (credit-note flow stays as is).
6. Checkout UI: show Stripe as an option next to Kustom and bank transfer; method icons; native fi/en/sv copy; no vendor names where infra-naming.mdc forbids them.
7. Platform tools: make oma.initiate_invoice_payment and oma.list_payment_gateways cover Stripe; a staff refund tool if missing (admin-MCP-first rule).
8. Test end to end in test mode: a card, Apple/Google Pay, MobilePay, SEPA, a failed card, a refund. Then the public smoke check after deploy.

Related

#136 (Stripe Connect for agencies) uses the same Lanetti Stripe account. Do this first.

Done when

Customers can pay OMA invoices and checkout orders with Stripe methods in production. Renewals can charge a saved card. Webhooks and refunds are reconciled. Tests and handbook (billing/payments.md) are updated.