docs: clarify first-payment non-PCI client authentication token flow

## Summary Update `docs/getting-started/first-payment.md` so the recommended non-PCI Stripe flow is documented end-to-end. ## Problem The current first-payment guide assumes the reader already has a `payment_method_id`, but does not clearly show how a non-PCI integration should obtain it. This creates confusion between browser SDK bootstrap and payment authorization. ## Proposed changes - document the non-PCI Stripe flow using client authentication token creation - show how the backend obtains the Stripe `client_secret` - show how Stripe.js / Stripe Elements returns `payment_method_id` - update the authorize examples to use the current tokenized authorize contract - refresh the related snippets to match the latest SDK request/response shapes - add multi-language backend variants for the client authentication token step ## Expected outcome The first-payment guide should present a coherent path: 1. create client authentication token 2. initialize Stripe.js / Elements 3. obtain `payment_method_id` 4. authorize using the tokenized payment method id