Feat/paykit payment lock demo

.github/workflows/check.yml

@@ -102,6 +102,9 @@ jobs:
           cargo nextest run -p locks-e2e --test production_creator_publishing_http
           cargo nextest run -p locks-e2e --test production_creator_authority_acquisition
 
+      - name: Install JS example dependencies
+        run: npm --prefix examples/js-sdk ci
+
       - name: JS/WASM SDK tests
         run: npm --prefix locks-sdk/bindings/js run test
 

README.md

@@ -52,9 +52,32 @@ your own 32-byte base64url key.
 
 Verified browser-facing defaults are:
 
-- Lock Server: <http://localhost:3000>
-- creator demo: <http://localhost:8080/examples/js-sdk/>
-- reader demo: <http://localhost:8081/reader/>
+- Lock Server: <http://127.0.0.1:3000>
+- creator demo: <http://127.0.0.1:8080/examples/js-sdk/>
+- reader demo: <http://127.0.0.1:8081/reader/>
+
+For the opt-in payment-lock demonstration, including Paykit Server, Bitcoin regtest,
+and Fulcrum:
+
+1. Build and start the complete stack from the repository root:
+
+```bash
+docker compose --file compose.paykit-local-demo.yaml up -d --build
+```
+
+2. Open the content-creator demo at <http://localhost:8080/examples/js-sdk/>.
+
+3. When using the local CLI authentication fallback, run `npm --prefix examples/js-sdk ...`
+   commands from the repository host. Do not wrap `authenticate` or `authenticate-paykit`
+   in `docker compose exec`; those wrappers load private role state on the host and bridge
+   only the bounded native-helper request into the demo container.
+
+Its external build contexts use anonymously reachable public repositories pinned to
+immutable commits; no sibling Paykit or Pubky checkout is required. The full demo adds
+Paykit Server at <http://127.0.0.1:3001> and publishes the reader at
+<http://127.0.0.1:8088/reader/>. Pubky Testnet is built from `pubky/pubky-core` source at
+commit `75eb1324f86e8caa16c41f18a2cd6b8e1909ee7b`, not from a released Pubky image or
+version. Payment remains a manual operator action.
 
 ## Documentation