Fix PCI Stripe e anteprima regia; checkout sempre hosted.

Blocca l'invio di numeri carta dall'API server, usa Checkout anche per i cambi piano e nasconde correttamente il placeholder video in regia.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/spec/config/stripe_pci_guard_spec.rb

@@ -0,0 +1,20 @@
+require "rails_helper"
+
+RSpec.describe StripePciGuard do
+  it "rileva hash carta grezza" do
+    expect(described_class.raw_card_hash?({ number: "4242424242424242" })).to be true
+    expect(described_class.raw_card_hash?({ exp_month: 12 })).to be true
+    expect(described_class.raw_card_hash?({ token: "tok_visa" })).to be false
+  end
+
+  it "blocca PaymentMethod.create con numero carta" do
+    skip "Stripe gem non caricata" unless defined?(Stripe::PaymentMethod)
+
+    expect {
+      Stripe::PaymentMethod.create(
+        type: "card",
+        card: { number: "4242424242424242", exp_month: 12, exp_year: 2034, cvc: "123" }
+      )
+    }.to raise_error(SecurityError, /PCI/)
+  end
+end

backend/spec/services/billing/stripe/checkout_session_spec.rb

@@ -0,0 +1,63 @@
+require "rails_helper"
+
+RSpec.describe Billing::Stripe::CheckoutSession do
+  let(:user) { User.create!(email: "checkout@test.it", name: "Owner", password: "password123", role: "coach") }
+  let(:club) do
+    Club.create!(
+      name: "Checkout Club", sport: "volleyball",
+      primary_color: "#e53935", secondary_color: "#ffffff",
+      billing_legal_name: "ASD Checkout", billing_email: "bill@test.it",
+      billing_address_line: "Via 1", billing_city: "Milano", billing_postal_code: "20100",
+      billing_vat_number: "12345678901", billing_recipient_code: "ABCDEFG"
+    )
+  end
+
+  before do
+    load Rails.root.join("db/seeds/plans.rb")
+    allow(MatchLiveTv).to receive(:stripe_enabled?).and_return(true)
+    allow(MatchLiveTv).to receive(:stripe_premium_light_price_id).and_return("price_light")
+    allow(MatchLiveTv).to receive(:stripe_premium_full_price_id).and_return("price_full")
+    allow(MatchLiveTv).to receive(:app_public_url).and_return("http://localhost:3000")
+    Plan.find_by!(slug: "premium_light").update!(stripe_price_id: "price_light")
+    Plan.find_by!(slug: "premium_full").update!(stripe_price_id: "price_full")
+  end
+
+  it "crea checkout senza subscription esistente" do
+    session = double(url: "https://checkout.stripe.com/test")
+    expect(Stripe::Customer).to receive(:create).and_return(double(id: "cus_new"))
+    expect(Billing::Stripe::CustomerSync).to receive(:call).with(club: club, customer_id: "cus_new")
+    expect(Stripe::Checkout::Session).to receive(:create).with(
+      hash_including(
+        mode: "subscription",
+        customer: "cus_new",
+        line_items: [{ price: "price_light", quantity: 1 }],
+        subscription_data: { metadata: { club_id: club.id, plan_slug: "premium_light" } }
+      )
+    ).and_return(session)
+
+    url = described_class.new(club: club, user: user, plan_slug: "premium_light").url
+    expect(url).to eq("https://checkout.stripe.com/test")
+  end
+
+  it "crea checkout per cambio piano con subscription esistente" do
+    Billing::AssignPlan.call(
+      club: club,
+      plan_slug: "premium_light",
+      status: "active",
+      stripe_attrs: { stripe_customer_id: "cus_x", stripe_subscription_id: "sub_x" }
+    )
+
+    session = double(url: "https://checkout.stripe.com/change")
+    expect(Billing::Stripe::CustomerSync).to receive(:call).with(club: club, customer_id: "cus_x")
+    expect(Stripe::Checkout::Session).to receive(:create).with(
+      hash_including(
+        customer: "cus_x",
+        subscription: "sub_x",
+        line_items: [{ price: "price_full", quantity: 1 }]
+      )
+    ).and_return(session)
+
+    url = described_class.new(club: club, user: user, plan_slug: "premium_full").url
+    expect(url).to eq("https://checkout.stripe.com/change")
+  end
+end