- app-config.js: public config placeholder (all null/false -> INERT). Operations
populates OIDC client + shop tenant + checkout URL at deploy; no secrets.
- checkout.js: Authorization Code + S256 PKCE (public client, no secret), state CSRF
guard, token in sessionStorage, code/state scrubbed from URL. Resolves premium via
the ledger's per-user /me/entitlements (user's own OIDC token, never the shared
read token) and sets window.SUCH_APP.premium for WebBillingManager. Redemption also
resolves on page reload / next login (crypto is webhook-driven).
- index.html: load config+checkout in <head>; CTA calls SUCH_APP_startCheckout, else
falls through to the store links (fail-closed). Store/itch buttons unchanged.
