fix: harden GoPay and 5sim PR paths

tests/five-sim-provider.test.js

@@ -127,9 +127,9 @@ test('5sim provider buys, checks, finishes, cancels, bans, and reuses activation
   );
 });
 
-test('5sim provider prefers buy-compatible products price over operator detail price', async () => {
-  const requests = [];
-  const provider = api.createProvider({
+test('5sim provider prefers buy-compatible products price over operator detail price', async () => {
+  const requests = [];
+  const provider = api.createProvider({
     fetchImpl: async (url, options = {}) => {
       const parsed = new URL(url);
       requests.push({ url: parsed, options });
@@ -172,11 +172,35 @@ test('5sim provider prefers buy-compatible products price over operator detail p
       '/v1/guest/prices',
       '/v1/user/buy/activation/vietnam/any/openai',
     ]
-  );
-});
-
-test('5sim provider reports raw buy payload when HTTP 200 response has no activation', async () => {
-  const provider = api.createProvider({
+  );
+});
+
+test('5sim provider rejects maxPrice with custom operator before buying', async () => {
+  const requests = [];
+  const provider = api.createProvider({
+    fetchImpl: async (url) => {
+      requests.push(url);
+      throw new Error(`unexpected request ${url}`);
+    },
+    sleepWithStop: async () => {},
+    throwIfStopped: () => {},
+  });
+
+  await assert.rejects(
+    () => provider.requestActivation({
+      fiveSimApiKey: 'demo-key',
+      fiveSimCountryId: 'vietnam',
+      fiveSimCountryLabel: '瓒婂崡 (Vietnam)',
+      fiveSimMaxPrice: '12',
+      fiveSimOperator: 'virtual21',
+    }),
+    /maxPrice only works when operator is "any"/
+  );
+  assert.deepStrictEqual(requests, []);
+});
+
+test('5sim provider reports raw buy payload when HTTP 200 response has no activation', async () => {
+  const provider = api.createProvider({
     fetchImpl: async (url) => {
       const parsed = new URL(url);
       if (parsed.pathname === '/v1/guest/products/vietnam/any') {