The shop says whether the money path is wired: Stripe with no webhook secret is named, and the admin sees which gateway takes the money #85

gateway.chosen() already has somewhere to say what is wrong with the configuration — the note it returns when STRIPE_SECRET_KEY is set but is not a test key — and it says nothing about the other half. With a test key and no STRIPE_WEBHOOK_SECRET, verifyWebhook returns false for every delivery (it refuses an empty secret before it looks at anything else), so POST /webhooks/stripe answers 400 to Stripe forever and an order settles only if the shopper happens to come back from the hosted page. Nothing anywhere says so: the note is rendered on the pay page for the shopper (src/pages/checkout.ts:182) and /admin never names the gateway at all.

Done looks like

• [ ] chosen() carries a note when kind === "stripe" and STRIPE_WEBHOOK_SECRET is empty, saying that deliveries are refused and an order settles only when the shopper returns.
• [ ] /admin shows one line naming the gateway in use — "Stripe (test mode)" or "Mock gateway" — with the note beside it when there is one, so the first page an admin opens answers "where does the money go".
• [ ] The note never contains a key, a prefix of a key, or the secret's length: it says which variable is missing, nothing about its value.
• [ ] Tests: with a test key and no webhook secret, chosen().note names it and /admin contains that sentence; with both set there is no note and /admin still names the gateway; with no key at all the existing "No STRIPE_SECRET_KEY is set" note is unchanged.
• [ ] The tests set and restore the environment around themselves so the suite stays order-independent under --randomize.

Files src/gateway.ts, src/admin.ts and src/pages/admin.ts for the dashboard line, src/server.test.ts or src/stripe.test.ts, README.md where it lists the two Stripe variables.

Risks This is the configuration only. #62 asks the larger question — whether a delivery has ever been heard and what is stuck unpaid — and is blocked behind #61; keep this small so #62 can absorb it rather than fight it. Do not make the app refuse to boot without a webhook secret: a preview with a test key and no webhook is a legitimate way to try the return path.

Suggested ledger, with sentinel reading the pull.