feat(pay): 同源收款测试页 GET /_test(Phase E 手动闭环验证)

pay-server 自带 /_test 测试页:创建订单→显示收款地址+精确金额(可复制)
+过期倒计时→轮询状态到 paid。同源、无 CORS/CSP 摩擦,不碰营销站安全头;
纯调 POST /order + GET /order/{id},无私钥无密钥。生产收银台后续走独角数卡门面。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

pay/internal/httpapi/handler.go

@@ -21,6 +21,7 @@ func New(svc *pay.Service, corsOrigins string) http.Handler {
 	mux := http.NewServeMux()
 	mux.HandleFunc("POST /order", h.createOrder)
 	mux.HandleFunc("GET /order/{orderNo}", h.getOrder)
+	mux.HandleFunc("GET /_test", h.testPage) // same-origin manual test harness (Phase E)
 	mux.HandleFunc("GET /healthz", func(w http.ResponseWriter, _ *http.Request) {
 		w.WriteHeader(http.StatusOK)
 		_, _ = w.Write([]byte("ok"))