Intentionally vulnerable AtRisk fixture. Fake Stripe secret is embedded in
config.js and inlined below for URL + repo correlation demos
(lean fetch collect does not load external scripts). Do not put real keys here.
STRIPE_SECRET_KEY=sk_live_atriskDemoOnly000000000000
Pay button (demo only):