Use a neutral host in the realm_from_url fixture (#159)

## Summary

`test_realm_from_url_derives_bare_host` used a real host as its example
URL. That host is going away, so the fixture now uses
`merchant.example.com`. The test's behavior is unchanged.

## Type of change

- [ ] Bug fix (no breaking change)
- [ ] New feature (no breaking change)
- [ ] Breaking change (existing callers must update)
- [x] Docs, tests, or internal maintenance only

## Public API

none

## Test plan

`uv run pytest tests/test_checkout.py -k realm_from_url` passes (1
passed). The full suite runs in CI.

## Checklist

- [x] Tests cover the new behavior, and the suite passes locally
- [x] Lint, format, and type checks pass
- [x] Docs and README examples updated if the public surface changed
- [x] No secrets, credentials, or personal data in the diff or the tests

Author: vvillait88

tests/test_checkout.py

@@ -992,7 +992,7 @@ def test_realm_from_url_derives_bare_host():
 
     # Full endpoint URL -> bare host (matches the Node SDK's new URL(APP_URL).host),
     # so the WWW-Authenticate realm is the protection space, not the full path.
-    assert _realm_from_url("https://agents.agentscore.com/purchase") == "agents.agentscore.com"
+    assert _realm_from_url("https://merchant.example.com/purchase") == "merchant.example.com"
     assert _realm_from_url("https://agents.example.com:8443/x/y") == "agents.example.com:8443"
     # No parseable host: pass through unchanged.
     assert _realm_from_url("agents.example.com") == "agents.example.com"