epic: build a secure provider test console for the PayBridge example app

[teesofttech]

Outcome

Provide a clear UI where contributors and evaluators can select a configured provider, initiate a sandbox payment, follow redirect/webhook state, verify status, and test refunds without editing source code.

Guardrails

• Browser code must never receive provider secret keys.
• The console must clearly distinguish mock, sandbox, and live modes.
• Destructive/live actions require explicit server-side policy and confirmation.
• Logs and payloads must be sanitized.

Acceptance criteria

• Provider selector shows configuration health and actual capabilities.
• Create, verify, and refund flows display a transaction timeline.
• Webhook events can be inspected safely.
• Accessible responsive UI works on mobile and desktop.
• Automated end-to-end tests cover at least two providers plus failure states.
• Child UI issues are linked from this epic.

[teesofttech]

Child backlog:

• demo-ui: keep sandbox credentials server-side and add safe environment controls #88 Establish secret and environment guardrails first
• demo-ui: expose provider discovery, capability, and configuration-health endpoints #83 Add provider discovery/capability endpoints
• demo-ui: implement payment, redirect, verification, refund, and webhook timeline #82 Implement the payment lifecycle timeline
• demo-ui: add Playwright end-to-end, accessibility, and responsive tests #87 Add Playwright, accessibility, and responsive coverage
• demo-ui: deploy an authenticated sandbox showcase with rate limits and observability #89 Deploy a hardened sandbox showcase