Fix e-payment settings payload, cart race, and media/content helpers.

Stop returning passwordSet (forbidNonWhitelisted), upsert carts safely, and harden related media/product/workshop flows.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/cart/cart.service.ts

@@ -279,21 +279,16 @@ export class CartService {
   }
 
   private async getOrCreateCart(businessId: bigint, userId: bigint) {
-    const existing = await this.prisma.cart.findUnique({
+    // Concurrent GETs (e.g. React Strict Mode) can race on create; upsert is safe.
+    const cart = await this.prisma.cart.upsert({
       where: {
         businessId_userId: { businessId, userId },
       },
+      create: { businessId, userId },
+      update: {},
     });
 
-    if (existing) {
-      return this.loadCart(existing.id);
-    }
-
-    const created = await this.prisma.cart.create({
-      data: { businessId, userId },
-    });
-
-    return this.loadCart(created.id);
+    return this.loadCart(cart.id);
   }
 
   private async loadCart(cartId: bigint): Promise<CartWithItems> {