Test checklist
- confirm the browser uses the sandbox public key
- confirm the backend uses the sandbox secret token
- verify the backend returns the transaction payload intact
- verify webhook delivery before trusting browser state
- reconcile any interrupted 3DS attempt

