feat: enforce production pricing provider config

docs/DEPLOYMENT.md

@@ -30,7 +30,10 @@ keeps database and Redis ports internal to the Compose network.
 Before starting, create a production `.env` containing real values for
 `POSTGRES_DB`, `POSTGRES_USER`, `POSTGRES_PASSWORD`, `DATABASE_URL`,
 `REDIS_URL`, `SMTP_URL`, `SMTP_FROM`, and a stable base64-encoded 32-byte
-`MFA_ENCRYPTION_KEY`. Do not use the fixture pricing provider in production.
+`MFA_ENCRYPTION_KEY`. Set `PRICING_HTTP_PROVIDER_ENDPOINT` to the approved
+provider's HTTPS endpoint and provide its token through
+`PRICING_HTTP_PROVIDER_TOKEN` when required. Production startup rejects the
+fixture provider, missing endpoints, and non-HTTPS endpoints.
 
 Start the stack and apply migrations with:
 

docs/IMPLEMENTATION-STATUS.md

@@ -143,6 +143,7 @@ Remaining roadmap areas are approved external provider credentials/adapters, bro
 - No initial User/Seller is provisioned in the development database yet. Run `npm run provision:admin` after setting its required local `.env` variables.
 - Listings are partially implemented: draft creation, seller-scoped reads, publication gating, lifecycle writes, archive behavior, sold/archived inventory checks, and item-owned image metadata are complete; storage-backed processing remains.
 - The provider abstraction, fixture provider, HTTP provider adapter, Product mapping workflow, durable refresh queue, worker execution, polling contract, retry policy, and completed-job purge operation are implemented. Production readiness still requires approved external provider credentials and provider-specific mapping data.
+- API and worker production startup now reject fixture pricing, missing provider endpoints, and non-HTTPS provider endpoints before opening runtime connections.
 - Pricing refresh requests now enqueue seller-scoped jobs and expose a safe `GET /api/v1/admin/jobs/:id` polling contract instead of doing provider work inline.
 - Product-level provider mappings now persist seller-scoped `PRODUCT`/`SEARCH` relationships and support active listing and controlled disabling.
 - Pricing refresh enqueue now resolves its provider from an active Product mapping and rejects unmapped Products explicitly.