checkout: drop auth wall so payment form mounts on page load

The auth-first flow blocked Stripe Elements from initialising for any
visitor without an existing Supabase session. Users hit the checkout
page, saw "Sign in to continue", and could not get to a card field at
all. Restored the inline-JS path (HEAD before extraction broke it),
flipped payment-section visible by default, kept the sign-in panel
behind an explicit "Already have an account? Sign in" link.

Build pipeline: added supabase_get stub injection and -lssl/-lcrypto
linker flags (web_stubs.c uses EVP for the AES-256-GCM transport).
Without those the Docker build aborts at link time.

Dockerfile.stage

@@ -25,6 +25,14 @@ WORKDIR /build
 COPY runtime/el_runtime.c runtime/el_runtime.h ./
 
 # ── Build neuron-web ──────────────────────────────────────────────────────────
+#
+# Inline-JS extraction (scripts/extract-js.py) is expected to run BEFORE the
+# wrapper concatenates src/*.el into dist/main-combined.el. That side of the
+# pipeline lives in build-local.sh (gated by EXTRACT_JS=1) and the outer
+# orchestrator. By the time we reach this Dockerfile, main-combined.el
+# already references /assets/js/<hash>.js and the corresponding asset files
+# have been emitted under src/assets/js/. The COPY of src/assets at the
+# runtime stage below is what ships those files into the container.
 COPY dist/web_stubs.c ./
 COPY dist/bootstrap.py ./
 COPY dist/main-combined.el ./
@@ -36,7 +44,7 @@ RUN python3 bootstrap.py main-combined.el > main.c && \
     cc -O2 -rdynamic \
        -o neuron-web \
        main.c web_stubs.c el_runtime.c \
-       -lcurl -lpthread -ldl -lm
+       -lcurl -lpthread -ldl -lm -lssl -lcrypto
 
 # ── Build soul-demo ───────────────────────────────────────────────────────────
 COPY dist/soul-demo.c ./
@@ -45,7 +53,7 @@ COPY dist/vessel_stubs.c ./
 RUN cc -O2 -rdynamic \
        -o soul-demo \
        soul-demo.c vessel_stubs.c el_runtime.c \
-       -lcurl -lpthread -ldl -lm
+       -lcurl -lpthread -ldl -lm -lssl -lcrypto
 
 # ── Stage 2: runtime image ────────────────────────────────────────────────────
 FROM debian:bookworm-slim