PRE-3709: Fix co-branded network selector in Hosted Fields

[adumont-payplug]

Description

With Unified Hosted Fields, a co-branded card makes the Dalenys brand iframe show several network logos plus a "Sélectionnez votre réseau (i)" label and tooltip. The iframe sat in a fixed 90x42px overflow: hidden box, so logos were cut off. The label is an absolutely positioned <div id="info-container"> that the SDK adds directly under <body>, with pixel coordinates measured once, so it landed on top of the expiry and CVV fields.

What changed:

• The card field gets its own row. A network row under it holds our own label and CSS-only tooltip on the left and the brand iframe (170x44px) on the right.
• The SDK's #info-container is hidden. Our label is shown only while the SDK reveals its own (body:has(...) on its inline display), so single-brand cards get no label.
• The label and tooltip are translated in fr, en and it (hosted_fields.network_selection.label and .tooltip).
• The static "CB" scheme badge is removed.
• CB is rejected: it is dropped from ALLOWED_BRANDS in hosted-fields_controller.js and from its server-side mirror in PayplugCardPersister. A shopper who picks CB in the SDK selector now gets the existing "unsupported brand" error.

Motivation: CB is not supported on this payment method, and co-branded cards could not be paid reliably because the selector and its label were unusable.

Related issue(s): PRE-3709

Notes for reviewer:

• Payment flow: not affected. Tokenization, order creation, IPN and refund/capture paths are unchanged. The only PHP change is the persister brand list, which only affects the fallback metadata of a saved card.
• Depends on SDK internals (Dalenys hosted-fields v2.2.0): the #info-container id and its inline display: none toggle. If an SDK upgrade changes either, our label stops appearing or the SDK's own label shows again. The brand iframe layout is not affected. Re-check on SDK upgrades.
• Browser support: :has() needs Chrome 105+, Safari 15.4+ or Firefox 121+. On older browsers the SDK label stays visible and ours never shows, which is the same as before this change.
• Tests run: ecs, phpstan, PHPUnit (602 tests) and twigcs pass. The persister change was written test-first. phpmd fails on 43 violations that exist without this change (same count with it stashed).
• Manual check: layout verified by hand in the QA shop with the co-branded card (label, tooltip, logos, no overlap). Not yet checked across all browsers or widths.
• Left out on purpose: a card-length limit. The card input is a cross-origin SDK iframe, so it needs an SDK option, which is unconfirmed. The server does not otherwise reject CB, so a CB payment posted without the JS check would still reach the capture.
• UPC: no UPC change or bump. Changelog: no entry added; the Sylius plugin's CHANGELOG.md is not maintained (it still only has a 2.0.0 section).
• hosted-fields.css is the tracked built file (there is no SCSS source in this repo), so it was edited directly.

---

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)

---

Checklist

Code Quality

• Code is linted and formatted
• No unnecessary commented-out code or debug logs
• No hardcoded values (use env variables or config)

Testing

• Unit tests added / updated
• New/changed code is covered by tests — SonarCloud Quality Gate (coverage on new code) passes on the sonarcloud CI job

Security & Ops

• No sensitive data or secrets introduced
• Logging and error handling are appropriate

Result (QA shop, Hosted Fields):

Single-brand test card: no network label, one logo right-aligned, VISA and MC badges only (CB badge removed).

Co-branded test card: label and tooltip trigger on the left, CB and VISA choices on the right, nothing overlapping expiry or CVV.

Co-branded card with CB selected: CB is rejected with the existing unsupported brand message.

[wiz-14d684d7a6]

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	-
Sensitive Data	-
Secrets	-
IaC Misconfigurations	-
SAST Findings	-
Software Management Findings	-
Total	-

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try the Wiz Code extension for VS Code, JetBrains, or Visual Studio.

[claude]

Claude Code Review

Claude Code Review is paused for this repository. To reconnect it, an admin of this repository's GitHub organization (or the account owner, for personal repositories) who can also manage your Claude organization's Code Review settings needs to re-link GitHub in Code Review settings. This is a one-time step.

_{Tip: disable this comment in your organization's Code Review settings.}