feat(core): session handshake + PactoSession

[aguilar1x]

Context

The SDK entry point for starting a checkout without exposing Gateway credentials.

Scope

• Pacto.init({ publishableKey }).
• pacto.createCheckoutSession({ listingId | quote, mode }) negotiates with the Gateway (OAuth-style handshake) and returns a short-lived clientSecret.
• Session expiration and refresh handling.

Acceptance criteria

• An invalid or expired session produces a typed error.
• The clientSecret cannot be escalated to other sessions.

Dependencies

#11 (needs the Gateway key model).

[jean1222312432]

Hello hello

Software Engineer with 5+ years of experience building scalable backend systems and enterprise applications. Currently working at Oracle, specializing in Node.js, NestJS, Express, and cloud-based solutions.

[grantfox-oss]

🦊 GrantFox — @jean1222312432 has been assigned to this issue as part of the Official Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #12)
2. Your PR will be reviewed by the PACTO-LAT maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Official Campaign campaign!

@jean1222312432's PR #22 was approved and merged by @aguilar1x.

🏆 @jean1222312432: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (83 total points). Track your full progress on GrantFox.

👏 Great work, @jean1222312432! Keep contributing to PACTO-LAT.