fix(buy): confirm placed orders via success banner / thank-you URL

[Multipixelone]

Problem

After clicking Place Order, the buy flow recognized a confirmation by only two signals (BasePurchaser._scrape_confirmation):

1. an order id matched in the body text, or
2. a grand total via ORDER_TOTAL_SELECTORS (Amazon's are stale TODO(amazon) guesses).

When neither matched, buy() routed to _submitted_unconfirmed → needs_review with the "⚠️ … the order MAY have been placed" warning. This fired on a genuinely successful Amazon order whose confirmation page rendered the canonical "Order placed, thanks!" banner — the code never checked for a success banner or the thank-you URL, so a real success was misreported as ambiguous.

Fix

Add a positive, first-class success signal:

• New base-class constants CONFIRMATION_MARKERS (success-banner body text) and CONFIRMATION_URL_MARKERS (thank-you URL fragments), checked by the new _looks_confirmed(page, body).
• _scrape_confirmation now returns (order_id, total, confirmed), where confirmed is true on any signal (banner / URL / order id / total). The retry loop breaks as soon as a positive signal appears.
• buy() decides on confirmed: a recognized banner/URL is authoritative → placed (review-page total stands in when none scrapes); only a total absence of signal → needs_review.
• Seeded markers for Amazon (from the observed "Order placed, thanks!" page + /gp/buy/thankyou) and Costco (backup to its order-number detection). Both flagged TODO: verify against live DOM.

The double-order safety is unchanged: post-submitted paths still never report failed.

Tests

• _scrape_confirmation callers updated to the 3-tuple; _ConfirmPage fixture gained a url.
• New: banner-only success, thank-you-URL-only success, and a regression that a blank page stays unconfirmed (needs_review).
• Full suite green: 161 passed, 3 skipped; mypy + ruff clean.

Verification done

• roomieorder dump-dom --provider amazon paper_towels: logged-in session OK, price read $30.99, add-to-cart present. dump-dom is read-only and never reaches the thank-you page, so it cannot verify the confirmation markers — those rest on the captured success screenshot and remain flagged TODO: verify.
• Side finding (out of scope): Amazon Buy-Now selectors probed count=0 on the live PDP — worth a future selector refresh.

Selector refresh (second commit)

roomieorder dump-dom --provider amazon paper_towels confirmed the live PDP DOM:

• Buy-Now was genuinely stale — the button is JS-injected by the turbo-checkout widget, so #buy-now-button / submit.buy-now never matched and the flow always fell back to add-to-cart → proceed. Now leads with Amazon's own turboState initiate selector [id^=buy-now-button], keeping the exact/legacy ids as fallbacks.
• Price and Add-to-Cart verified working — comments refreshed; dead #submit\.buy-now guess dropped.
• Place-Order / order-total left unchanged — correction to the original note: their count=0 was because they live on the checkout/confirmation pages, which a PDP dump can't reach. That is not evidence of staleness, so they stay flagged TODO(amazon) rather than blindly re-guessed.

Follow-ups

• Confirm the Amazon banner wording / thank-you URL fragment and the place-order / order-total selectors against a real order (only the live checkout/confirmation pages reach them), then drop the remaining TODO(amazon) flags.