Payment is completed on Shopify's hosted checkout.
This step hands off to Shopify's hosted checkout, which owns the card form and the PCI scope end to end — nothing here ever collects a card number. That handoff is wired once this drop's Shopify product IDs land (they're all still null — see OPEN.md). For tonight, this is as far as the flow goes.
