feat: cvm commerce sidecar for stripe checkout and webhooks

[daopunk]

Summary

• Accept Option A hosting: Stripe Checkout + webhooks run as signal-commerce on the existing Phala CVM (:8082); GitHub Pages stays static (decision ADR)
• Add entitlements cross-process safety (flock + reload_if_stale + with_disk_lock) so bot and commerce can share entitlements.enc
• Implement signal-commerce: POST /v1/checkout/sessions, signed POST /v1/webhooks/stripe, health — all-access SKUs only (all-access-3 / all-access-10)
• Wire Dockerfile/compose/Phala + env placeholders (STRIPE_*, SITE_*); empty Stripe key keeps health up for local bring-up

Closes #52. Unblocks #55 / #56 / #64 spine; catalog Price ID seed remains #79 (sk_test_…).

Test plan

• cargo test -p signal-bot --lib entitlements_store
• cargo test -p signal-commerce
• cargo clippy -p signal-commerce --all-targets -- -D warnings
• npm run ci (or pnpm run ci) before merge
• Optional local: docker compose -f docker/compose.yaml --env-file docker/.env up -d → curl localhost:8082/health
• After ops: seed stripe test catalog and write price ids to docs #79 seed: set Price IDs + webhook secret; Stripe test Checkout → success ?code= / ?plan= → !link