checkout: drop auth wall so payment form mounts on page load

The auth-first flow blocked Stripe Elements from initialising for any
visitor without an existing Supabase session. Users hit the checkout
page, saw "Sign in to continue", and could not get to a card field at
all. Restored the inline-JS path (HEAD before extraction broke it),
flipped payment-section visible by default, kept the sign-in panel
behind an explicit "Already have an account? Sign in" link.

Build pipeline: added supabase_get stub injection and -lssl/-lcrypto
linker flags (web_stubs.c uses EVP for the AES-256-GCM transport).
Without those the Docker build aborts at link time.

build-local.sh

@@ -6,8 +6,12 @@
 # and the soul dies with it. No separate process manager. No port conflicts.
 #
 # Usage:
-#   ./build-local.sh          — build only
-#   ./build-local.sh --run    — build and start both servers
+#   ./build-local.sh                  — build only (fast, leaves inline JS as-is)
+#   ./build-local.sh --run            — build and start both servers
+#   EXTRACT_JS=1 ./build-local.sh     — also extract inline <script> blocks
+#                                       into hashed, minified, obfuscated
+#                                       /assets/js/<hash>.js files. Production
+#                                       deploys should always extract.
 
 set -euo pipefail
 cd "$(dirname "$0")"
@@ -22,6 +26,18 @@ COMPONENTS=(nav hero pillars how_it_works inference efficiency comparison
   footer styles about founding_badge terms enterprise_terms checkout safety
   gallery account)
 
+# Optional inline-JS extraction. Off by default for fast dev iteration; the
+# script is idempotent so flipping the flag on a prior tree just reuses
+# previously-extracted assets and emits a complete manifest.
+if [[ "${EXTRACT_JS:-0}" == "1" ]]; then
+  echo "==> Extracting inline JS → src/assets/js/"
+  if [ ! -x "node_modules/.bin/terser" ] || [ ! -x "node_modules/.bin/javascript-obfuscator" ]; then
+    echo "    installing terser + javascript-obfuscator (no-save)..."
+    npm install --no-save --silent terser javascript-obfuscator
+  fi
+  python3 scripts/extract-js.py
+fi
+
 echo "==> Combining El sources"
 {
   for f in "${COMPONENTS[@]}"; do
@@ -35,7 +51,7 @@ echo "==> Bootstrap El → C"
 python3 "${BOOTSTRAP}" dist/main-combined.el > dist/main.c
 
 echo "==> Injecting stubs"
-sed -i '' 's|#include "el_runtime.h"|#include "el_runtime.h"\nel_val_t http_get_auth(el_val_t url, el_val_t tok);\nel_val_t http_post_auth(el_val_t url, el_val_t tok, el_val_t body);\nel_val_t cwd(void);\nel_val_t color_bold(el_val_t s);\nel_val_t unix_timestamp(void);\nel_val_t gcs_write(el_val_t bucket, el_val_t object_name, el_val_t content);\nel_val_t gcs_read(el_val_t bucket, el_val_t object_name);\nel_val_t supabase_insert(el_val_t project_url, el_val_t service_key, el_val_t table, el_val_t row_json);|' dist/main.c
+sed -i '' 's|#include "el_runtime.h"|#include "el_runtime.h"\nel_val_t http_get_auth(el_val_t url, el_val_t tok);\nel_val_t http_post_auth(el_val_t url, el_val_t tok, el_val_t body);\nel_val_t cwd(void);\nel_val_t color_bold(el_val_t s);\nel_val_t unix_timestamp(void);\nel_val_t gcs_write(el_val_t bucket, el_val_t object_name, el_val_t content);\nel_val_t gcs_read(el_val_t bucket, el_val_t object_name);\nel_val_t supabase_insert(el_val_t project_url, el_val_t service_key, el_val_t table, el_val_t row_json);\nel_val_t supabase_get(el_val_t project_url, el_val_t service_key, el_val_t table_and_query);|' dist/main.c
 
 echo "==> Compiling neuron-web"
 cc -O2 \