fix(rcart): make payment pages publicly accessible

Payment request URLs (e.g. /rcart/pay/:id) should be accessible without
authentication, even in private spaces. The API endpoints were already
exempted from auth, but the client-side shell gate was redirecting
unauthenticated visitors to the module landing page. Set
spaceVisibility="public" on the payment page render to bypass this.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

modules/rcart/mod.ts

@@ -2455,6 +2455,7 @@ routes.get("/pay/:id", (c) => {
 		title: `Payment | rCart`,
 		moduleId: "rcart",
 		spaceSlug: space,
+		spaceVisibility: "public", // Payment pages are always public
 		modules: getModuleInfoList(),
 		theme: "dark",
 		body: `<folk-payment-page space="${space}" payment-id="${paymentId}"></folk-payment-page>`,