NFR-0001 — Isolate payment credentials

Constraint: PayPal client credentials shall remain server-only, runtime-injected, and absent from Git, browser bundles, responses, and logs. Measurable target: Secret scans find no credential value; client bundles contain no server credential variable; API failures return sanitized messages. Scope: PayPal BFF and ESHOPV1-FT-3. Status: Proposed; implementation candidate. Verification: Repository secret scan, production bundle inspection, route tests, and deployed Sandbox failure-path test. Evidence: Application commit 7fd6b88; deployed verification remains blocked.