docs(fiat-checkout): Orders is live in sandbox — point the tutorial at the deployed endpoints

[aaitor]

Why this matters

The Fiat Checkout tutorial told readers the Nevermined Orders backend wasn't shipped yet — that they had to build it locally from a feature branch to try the flow. That's no longer true: Orders is deployed in sandbox (both the /api/v1/orders API and the hosted embed checkout), and the deployed showcase panel now runs against it. This updates the docs so a reader can point the tutorial at the live sandbox and just supply their org key, instead of standing up a local stack.

Changes

• fiat-checkout-chat/README.md — the "Prerequisite" section now leads with the deployed sandbox endpoints (api.sandbox.nevermined.app, embed.nevermined.app); the local-stack instructions move into a collapsible <details> as the alternative. Env table shows sandbox values (local noted). Sanity-check curl uses $NVM_API_BASE_URL instead of a hardcoded localhost.
• fiat-checkout-chat/.env.example — NVM_API_BASE_URL / NVM_EMBED_BASE_URL default to the sandbox URLs (local as a comment).
• showcase/content/tutorials.ts — the "See it run" note no longer says "the local stack now, the sandbox once Orders ships".

No code/behaviour change; the .ts edit is a display-string only.

Test plan

• next build type-checks content/tutorials.ts (CI verify job).
• README/.env.example are docs — proofread; markdown tables have proper headers.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GYjpDX5ZRMGrpSZ8zAMLg3

[r-marques]

👀 Reviewing

[r-marques]

🤖 Automated PR review — 🟡 Mergeable with nits

Flips the fiat-checkout tutorial from "run the stack locally from a feature branch" to "point at the deployed sandbox", demoting the local path to a <details> block. The whole PR rests on one claim — that Orders is actually deployed — so I verified it rather than took it, and it holds. No blockers.

What I verified

• Diff range origin/main...HEAD — 3 files, +39/−26, head d82fc0a6a.
• No panel — a docs diff, verified directly against the live endpoints and the deployed source. Saying so rather than implying coverage I do not have.
• The Orders API is live. POST https://api.sandbox.nevermined.app/api/v1/orders returns 401, while a bogus sibling (/api/v1/orders-nope) returns 404 — the control is what makes the 401 meaningful rather than a blanket response.
• The hosted checkout route shipped. #3249 merged as PR #3330 on 2026-09-07, and apps/embed/src/routes/checkout.order.$orderId.tsx is present in v1.35.1, which is the tag production-embed is currently running.
• The sandbox: key-prefix fix is right. Changing the example from sandbox-… to sandbox:… matches the real org key format (colon, not hyphen) — a small correction, but it is the kind that silently costs someone an afternoon.

Two dead ends, recorded so nobody re-walks them. Both looked like evidence and neither is:

• HTTP status on the embed host proves nothing. /checkout/order/<anything> returns 200 — but so does /zzz-nonexistent-route. It is an SPA fallback serving the same shell for every path.
• Absence of a route-named JS chunk proves nothing either. The deployed bundle ships checkout._did but no checkout.order chunk, which reads like the route is missing. It is not: cards.list.tsx and checkout.plan.$planId.tsx have been on main since May and also have no named chunk, so some routes are bundled into app-*.js. I had this one lined up as a blocker before testing the inference; the tag check above is what actually settles it.

Verdict: 🟡 Mergeable with nits — 0 blockers, 0 should-fix, 1 nit. The nit is one clause of explanation in a table, not a correction.

🧭 Inline comments (1)

Each is posted on its line in Files changed.

• 💡 NIT — One host says sandbox, the other doesn't — worth one sentence so a reader doesn't think it's a typo — fiat-checkout-chat/README.md:86

[r-marques]

🟡 Approved with comments — no blockers; 0 should-fix, 1 nit(s) left inline.

Inline review: #76 (review)