test(payments): keep Stripe webhook creation out of CI runs

With real Stripe test credentials now present in CI, the previously
skipped payment tests started running - and every path that registers a
webhook endpoint against the real Stripe API died with "Can not create
the Stripe Webhook": Stripe rejects non-publicly-accessible URLs
server-side (verified empirically: WebhookEndpoint::create with the CI
APP_URL fails with "Invalid URL: URL must be publicly accessible"), so
no localhost environment can ever exercise webhook creation, regardless
of local configuration.

Two treatments:

- OAuth2SummitOrdersApiTest: the payment profile is built with
  pre-seeded webhook data (set_webhooks + test_web_hook_secret from the
  TEST_STRIPE_WEBHOOK_SECRET secret), the factory's escape hatch for
  pre-existing webhooks - activate()->buildWebHook() then short-circuits
  on existsWebHook() and never calls Stripe. This lets
  testReserveWithActivePaymentProfile actually exercise the paid
  reservation flow (real PaymentIntent in test mode) in CI.

- OAuth2PaymentGatewayProfileApiTest (add/update/delete): profile
  creation through the API always registers a webhook endpoint (the API
  validation rules accept no pre-seeded webhook data), so these tests
  are environment-gated: they now also skip when APP_URL is localhost,
  with the real reason documented. They run only against an environment
  with a publicly routable URL.

Author: smarcet

tests/oauth2/OAuth2PaymentGatewayProfileApiTest.php

@@ -160,8 +160,11 @@ public function testAddProfileFail(){
 
 
     public function testAddProfileOK(){
-        if (self::$test_secret_key === 'sk_test_dummy_key') {
-            $this->markTestSkipped('Valid Stripe test credentials required (TEST_STRIPE_SECRET_KEY env var).');
+        if (self::$test_secret_key === 'sk_test_dummy_key' || str_contains((string)env('APP_URL'), 'localhost')) {
+            // profile creation through the API always registers a webhook endpoint
+            // against the real Stripe API, and Stripe rejects non-public URLs -
+            // this flow cannot run from CI (APP_URL=localhost)
+            $this->markTestSkipped('Valid Stripe test credentials and a publicly accessible APP_URL are required (webhook creation hits the real Stripe API).');
         }
         $params = [
             'id' => self::$summit->getId(),
@@ -202,8 +205,11 @@ public function testAddProfileOK(){
     }
 
     public function testUpdateOK(){
-        if (self::$test_secret_key === 'sk_test_dummy_key') {
-            $this->markTestSkipped('Valid Stripe test credentials required (TEST_STRIPE_SECRET_KEY env var).');
+        if (self::$test_secret_key === 'sk_test_dummy_key' || str_contains((string)env('APP_URL'), 'localhost')) {
+            // profile creation through the API always registers a webhook endpoint
+            // against the real Stripe API, and Stripe rejects non-public URLs -
+            // this flow cannot run from CI (APP_URL=localhost)
+            $this->markTestSkipped('Valid Stripe test credentials and a publicly accessible APP_URL are required (webhook creation hits the real Stripe API).');
         }
         $params = [
             'id' => self::$summit->getId(),
@@ -276,8 +282,11 @@ public function testUpdateOK(){
     }
 
     public function testDelete(){
-        if (self::$test_secret_key === 'sk_test_dummy_key') {
-            $this->markTestSkipped('Valid Stripe test credentials required (TEST_STRIPE_SECRET_KEY env var).');
+        if (self::$test_secret_key === 'sk_test_dummy_key' || str_contains((string)env('APP_URL'), 'localhost')) {
+            // profile creation through the API always registers a webhook endpoint
+            // against the real Stripe API, and Stripe rejects non-public URLs -
+            // this flow cannot run from CI (APP_URL=localhost)
+            $this->markTestSkipped('Valid Stripe test credentials and a publicly accessible APP_URL are required (webhook creation hits the real Stripe API).');
         }
 
         $params = [

tests/oauth2/OAuth2SummitOrdersApiTest.php

@@ -76,6 +76,11 @@ protected function setUp():void
             'test_publishable_key' => self::$test_public_key,
             'test_secret_key'      => self::$test_secret_key,
             'is_active'            => false,
+            // pre-seed the webhook data so activate()->buildWebHook() never tries to
+            // register a webhook endpoint against the real Stripe API - CI's APP_URL
+            // (localhost) is not publicly routable, so Stripe would reject it
+            'set_webhooks'         => true,
+            'test_web_hook_secret' => env('TEST_STRIPE_WEBHOOK_SECRET', 'whsec_dummy'),
         ]);
 
         // build default badge type