Añade gold y transfer: patrón de pago unificado con fulfill + metadata

- lib/stripe.ts: createCheckoutSession acepta metadata; claimPaidCheckout la
  recupera de la sesión Stripe y la devuelve.
- lib/paid-services.ts: config unificado con fulfill(character, meta) + extraFields.
  gold -> UPDATE characters money (BD directa, no SOAP), transfer -> SOAP
  .char changeaccount. Los 5 simples usan soapFulfill.
- checkout [service]: lee extraFields -> metadata, precio depende de metadata (gold),
  valida precio>0. service-success llama cfg.fulfill(name, metadata).
- prices.ts: getTransferPrice, getGoldOptions/goldPriceFor (home_goldprice).
- GoldForm (personaje + cantidad) y TransferForm (personaje + destino); páginas
  /gold y /transfer. Catálogos Paid.gold/transfer.

Verificado: /gold /transfer redirigen a login, checkout 401 sin sesión, home OK.
NOTA: transfer no valida aún el token de seguridad ni reglas AC (nivel>=55, DK).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

web-next/lib/stripe.ts

@@ -25,6 +25,7 @@ export interface CheckoutParams {
   successUrl: string
   cancelUrl: string
   currency?: string
+  metadata?: Record<string, string>
 }
 
 /** Crea una sesión de pago Stripe y registra el StripeLog. Devuelve la URL de checkout. */
@@ -49,6 +50,7 @@ export async function createCheckoutSession(
       mode: 'payment',
       success_url: successUrl,
       cancel_url: p.cancelUrl,
+      metadata: p.metadata,
     })
     const mode = (process.env.STRIPE_SECRET_KEY || '').startsWith('sk_live') ? 'live' : 'test'
     await db(DB.default).query(
@@ -67,8 +69,18 @@ export async function createCheckoutSession(
  * (evita re-entregas). Devuelve el character_name del log o null. (Port de
  * require_paid_stripe.)
  */
-export async function claimPaidCheckout(sessionId: string): Promise<{ characterName: string } | null> {
-  if (!(await isSessionPaid(sessionId))) return null
+export async function claimPaidCheckout(
+  sessionId: string,
+): Promise<{ characterName: string; metadata: Record<string, string> } | null> {
+  if (!sessionId) return null
+  let metadata: Record<string, string> = {}
+  try {
+    const s = await stripe.checkout.sessions.retrieve(sessionId)
+    if (s.payment_status !== 'paid') return null
+    metadata = (s.metadata as Record<string, string>) ?? {}
+  } catch {
+    return null
+  }
   const [rows] = await db(DB.default).query<RowDataPacket[]>(
     'SELECT id, character_name, fulfilled FROM home_stripelog WHERE session_id = ?',
     [sessionId],
@@ -76,5 +88,5 @@ export async function claimPaidCheckout(sessionId: string): Promise<{ characterN
   const log = rows[0]
   if (!log || log.fulfilled) return null
   await db(DB.default).query('UPDATE home_stripelog SET fulfilled = 1 WHERE id = ?', [log.id])
-  return { characterName: log.character_name }
+  return { characterName: log.character_name, metadata }
 }