Stands in for a merchant page (e.g. hotels-web). Loads the loader, mounts the styled card
iframe, gets a token, then drives the 3-D Secure challenge. Two Pay buttons: one does the real
tokenize against UAT; the other also simulates a bank challenge (needs
XENIPAY_MOCK_3DS=1).