Test the checkout code; publish images only for releases (#5)

- src/checkout/ (PayPal order request, pricing, VAT) and src/logging/format.ts
  hold the checkout's pure code, moved out of PayPalApi, the product service
  and config without a behaviour change.
- npm test runs node:test on the TypeScript sources (type stripping), with no
  dependencies: 21 tests, 13 pin today's output, 8 describe the correct
  behaviour for the known defects of libretech/mp#67
  and are marked todo.
- CI: the tests run in the image's base (node:22.14.0-alpine) for every pull
  request, push to main and release tag. The image is built for pull requests
  and built and published only for v* tags; main no longer publishes :main
  and :sha-* images.

Refs libretech/mp#71

Co-authored-by: Michael Czechowski <mail@librete.ch>

config/constants.ts

@@ -1,4 +1,5 @@
 import { Environment } from "@paypal/paypal-server-sdk";
+import { vatDecimal } from "../src/checkout/vat";
 
 export const pdfApiUrl = process.env.PDF_API_ADDRESS!;
 export const mailApiUrl = process.env.MAIL_API_ADDRESS!;
@@ -18,10 +19,7 @@ export const shopEmail = process.env.SHOP_EMAIL ?? process.env.ADMIN_EMAIL_ADDRE
 export const shopLogoUrl = process.env.SHOP_LOGO_URL ?? "";
 export const shopSecondaryLogoUrl = process.env.SHOP_SECONDARY_LOGO_URL ?? "";
 
-// TODO: Should be retrieved from DepotApi
-export const vatIncludedDecimal = 1.19;
-// TODO: Should be retrieved from DepotApi
-export const vatDecimal = 0.19;
+export { vatIncludedDecimal, vatDecimal } from "../src/checkout/vat";
 export const vatDecimalExcluded = 1 - vatDecimal;
 
 export const maxProductsSitemap = 500;