feat: Stripe Checkout, Zeptomail, pre-alert linking, perfil 3-tab, carga-pesada landing

- payments: real Stripe Checkout Session (redirect flow), confirmBySession, webhook handler
- notifications: Zeptomail REST email, wa.me WhatsApp links, IntegrationsService injection
- auth: changePassword, updateProfile, disableMfa (TOTP-verified) endpoints
- packages: tryLinkPreAlert() auto-links on create (non-blocking)
- integrations: catalog updated (zeptomail, stripe_webhook_secret; removed sendgrid/whatsapp-api)
- web/portal/perfil: 3-tab layout (datos / contraseña / MFA)
- web/portal/pago: Stripe redirect + ?success=1&session_id= callback, cancelled banner
- web/admin/b2b: fix enum values (EN_COTIZACION, ACEPTADO)
- web/carga-pesada: rich marketing landing (FCL/LCL, 7-step process, sectors, INEN callout)
- tests: fix payments.service.spec (IntegrationsService+ConfigService mocks)
- tests: fix notifications.service.spec (IntegrationsService mock, phone in mockUser)
- all 104 tests passing, API + web builds clean

apps/api/src/packages/packages.service.ts

@@ -81,9 +81,40 @@ export class PackagesService {
       },
     });
 
+    // Intentar vincular con pre-alerta pendiente del mismo usuario (§09)
+    await this.tryLinkPreAlert(pkg.id, dto.userId, tenantId, dto.vendorTracking);
+
     return pkg;
   }
 
+  /** Busca una pre-alerta PENDIENTE del mismo usuario que coincida por vendorTracking
+   *  y la vincula automáticamente al paquete (status → VINCULADA, packageId set). */
+  private async tryLinkPreAlert(
+    packageId: string,
+    userId: string,
+    tenantId: string,
+    vendorTracking?: string,
+  ): Promise<void> {
+    try {
+      const where: any = { tenantId, userId, status: "PENDIENTE", packageId: null };
+      if (vendorTracking) where.vendorTracking = vendorTracking;
+
+      const alert = await this.prisma.client.preAlert.findFirst({
+        where,
+        orderBy: { createdAt: "desc" },
+      });
+
+      if (!alert) return;
+
+      await this.prisma.client.preAlert.update({
+        where: { id: alert.id },
+        data: { packageId, status: "VINCULADA" },
+      });
+    } catch {
+      // Non-blocking — linking failure must not block package creation
+    }
+  }
+
   async updateStatus(id: string, dto: UpdateStatusDto, operatorId: string): Promise<any> {
     const pkg = await this.prisma.client.package.findUnique({ where: { id } });
     if (!pkg) throw new NotFoundException("Paquete no encontrado.");