test(nodejs): add checkout behavioral test suite

[vishkaty]

Closes the Node.js behavioral test gap described in #136.

What

Adds a behavioral test suite for the Node.js sample, mirroring the Python
server's coverage on the CI lane added in #126, so a regression in the checkout
flow no longer ships green. It uses the existing node:test + app.request()
conventions and adds no dependencies.

Area	Coverage
lifecycle.test.ts	create → retrieve → complete (order assigned), payment-failure (402), cancel, and completed/canceled immutability (409)
idempotency.test.ts	same-key replay returns the original checkout; same-key + different body → 409; keyless requests stay independent
validation_flow.test.ts	unknown product and over-stock are rejected; in-stock succeeds
discount.test.ts (extended)	case-insensitive code match, empty codes[] clears discounts, and allocations[] reconcile to the applied amount

Why

The Node.js suite was three files; the Python server has a full behavioral
suite. That asymmetry meant checkout-flow regressions on the Node.js sample
passed CI. These tests exercise the real service handlers end to end through a
minimal Hono app (the same approach as discovery.test.ts), so they catch
behavioral drift, not just types.

Verification

• npm run build clean and npm test green (21 tests).
• pre-commit run clean (prettier, codespell).

Happy to split this into per-area PRs if that reviews more easily — offered in
#136; opening it as one small suite here since the areas share the harness.

[vishkaty]

Heads-up @damaz91 — I rebased this onto latest main and adapted it to the @ucp-js/sdk refactor from #139: the suite now uses the SDK's schemas (CheckoutCompleteRequestSchema etc.) via src/models, matching how the sample consumes the SDK now, and the complete-request payloads use the new payment: { instruments: [...] } shape.

While rebasing I also added the fulfillment area — options are quoted, selecting one adds its cost to the receipt, and completing without a fulfillment selection is rejected — which completes the coverage I offered in #136.

Clean single commit on latest main; full suite green (25 tests), npm run build (tsc) clean, pre-commit clean. Sorry to reset your approval — ready for another look whenever you have a moment. 🙏