Tienda Battlepay: pago de órdenes pendientes vía Stripe

Reutiliza la infraestructura Stripe (sin depender de SumUp/credenciales externas):
- lib/battlepay.ts: getPendingOrders/getPendingOrder/markOrderPaid sobre
  acore_auth.battlepay_orders (PENDING->PAID, el mod-battlepay entrega en juego).
- fulfill.ts: rama battlepay (metadata.battlepay_reference -> markOrderPaid),
  idempotente vía el claim atómico compartido con el webhook.
- API POST /api/battlepay/pay (valida orden PENDING de la cuenta, crea checkout).
- UI: /battlepay (lista + pagar) y /battlepay-success (entrega compartida),
  enlace "Tienda" en la cabecera para usuarios logueados.
- i18n es/en: namespace Battlepay + Nav.store.

Verificado: build OK, /battlepay 307->login, API 401 sin sesión, success 200.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

web-next/lib/battlepay.ts

@@ -0,0 +1,55 @@
+import type { RowDataPacket, ResultSetHeader } from 'mysql2'
+import { db, DB } from './db'
+
+export interface BattlepayOrder {
+  id: number
+  reference: string
+  product_id: number
+  product_name: string
+  price_eur: number
+  status: string
+  created_at: number | null
+}
+
+/** Órdenes Battlepay PENDING de una cuenta de juego. */
+export async function getPendingOrders(accountId: number): Promise<BattlepayOrder[]> {
+  try {
+    const [rows] = await db(DB.auth).query<RowDataPacket[]>(
+      "SELECT id, reference, product_id, product_name, price_eur, status, created_at " +
+        "FROM battlepay_orders WHERE account_id = ? AND status = 'PENDING' ORDER BY created_at DESC",
+      [accountId],
+    )
+    return rows.map((r) => ({
+      id: r.id,
+      reference: r.reference,
+      product_id: r.product_id,
+      product_name: r.product_name,
+      price_eur: Number(r.price_eur),
+      status: r.status,
+      created_at: r.created_at ?? null,
+    }))
+  } catch {
+    return []
+  }
+}
+
+/** Orden PENDING concreta que pertenece a la cuenta (para crear el pago). */
+export async function getPendingOrder(
+  reference: string,
+  accountId: number,
+): Promise<{ product_name: string; price_eur: number } | null> {
+  const [rows] = await db(DB.auth).query<RowDataPacket[]>(
+    "SELECT product_name, price_eur FROM battlepay_orders WHERE reference = ? AND account_id = ? AND status = 'PENDING'",
+    [reference, accountId],
+  )
+  return rows[0] ? { product_name: rows[0].product_name, price_eur: Number(rows[0].price_eur) } : null
+}
+
+/** Marca una orden como PAID solo si estaba PENDING. Devuelve true si cambió algo. */
+export async function markOrderPaid(reference: string): Promise<boolean> {
+  const [res] = await db(DB.auth).query<ResultSetHeader>(
+    "UPDATE battlepay_orders SET status = 'PAID', paid_at = UNIX_TIMESTAMP() WHERE reference = ? AND status = 'PENDING'",
+    [reference],
+  )
+  return res.affectedRows > 0
+}

web-next/lib/fulfill.ts

@@ -1,5 +1,6 @@
 import { claimPaidCheckout } from './stripe'
 import { getPaidService } from './paid-services'
+import { markOrderPaid } from './battlepay'
 
 export interface FulfillResult {
   ok: boolean
@@ -22,6 +23,12 @@ export async function fulfillCheckoutSession(
   const claim = await claimPaidCheckout(sessionId)
   if (!claim) return { ok: false, service: fallbackService ?? null, character: null }
 
+  // Rama Battlepay: marca la orden como PAID (el mod-battlepay la entrega en juego).
+  if (claim.metadata.battlepay_reference) {
+    const ok = await markOrderPaid(claim.metadata.battlepay_reference)
+    return { ok, service: 'battlepay', character: null }
+  }
+
   const service = claim.metadata.service || fallbackService || ''
   const cfg = service ? getPaidService(service) : null
   if (!cfg) return { ok: false, service: service || null, character: claim.characterName }