Test Payment Config

Prove the credentials authenticate: the submitted form values win, a blank api_key falls back to the stored (decrypted) or env one — so the test probes exactly what a save would put into use. One-shot client: an untested credential set must not enter the pooled cache.