feat(helcim): accept signup-bridge cookie in verify-payment

Membership signup verifies the card before email verification, so the
signup-bridge cookie set by /api/helcim/customer now satisfies auth in
verify-payment when no session exists. Adds a cloudflared tunnel script
for testing the Helcim flow locally against a production build.

tests/server/api/helcim-payment.test.js

@@ -1,6 +1,6 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 
-import { requireAuth, getOptionalMember } from '../../../server/utils/auth.js'
+import { requireAuth, getOptionalMember, getSignupBridgeMember } from '../../../server/utils/auth.js'
 import { validateBody as importedValidateBody } from '../../../server/utils/validateBody.js'
 import { loadPublicEvent } from '../../../server/utils/loadEvent.js'
 import { loadPublicSeries } from '../../../server/utils/loadSeries.js'
@@ -12,7 +12,8 @@ import { createMockEvent } from '../helpers/createMockEvent.js'
 
 vi.mock('../../../server/utils/auth.js', () => ({
   requireAuth: vi.fn(),
-  getOptionalMember: vi.fn()
+  getOptionalMember: vi.fn(),
+  getSignupBridgeMember: vi.fn()
 }))
 vi.mock('../../../server/utils/validateBody.js', () => ({ validateBody: vi.fn() }))
 vi.mock('../../../server/utils/schemas.js', () => ({ paymentVerifySchema: {} }))
@@ -367,4 +368,27 @@ describe('verify-payment endpoint', () => {
       statusMessage: 'Payment method not found or does not belong to this customer'
     })
   })
+
+  it('accepts the signup-bridge cookie without requiring auth', async () => {
+    const body = { customerId: 'cust-1', cardToken: 'tok-match' }
+    getSignupBridgeMember.mockResolvedValue({ _id: 'm1' })
+    importedValidateBody.mockResolvedValue(body)
+
+    mockFetch.mockResolvedValue({
+      ok: true,
+      text: async () => JSON.stringify([{ cardToken: 'tok-match' }])
+    })
+
+    const event = createMockEvent({
+      method: 'POST',
+      path: '/api/helcim/verify-payment',
+      body
+    })
+
+    const result = await verifyPaymentHandler(event)
+
+    expect(result.success).toBe(true)
+    expect(getSignupBridgeMember).toHaveBeenCalledWith(event)
+    expect(requireAuth).not.toHaveBeenCalled()
+  })
 })