v4: add payment lifecycle operations

[Phloraxx]

Scope

Fourth stacked PayGate v4 implementation slice. Depends on PR #45.

Implements

• read payment + reconstruct canonical UPI URI from immutable snapshot
• idempotent payment cancellation
• cancellation refuses already-paid/expired terminal payments
• grace-aware expiry sweep: pending payments become expired only after grace_until
• cancellation/expiry write immutable payment history and durable webhook outbox rows transactionally
• webhook envelope uses the durable event ID and actual transition timestamp
• cancelled/expired payments keep their amount reservation until the original reuse_after; status changes do not free decimals early

Tests

Covers get/not-found, cancellation idempotency, terminal-state protection, reservation retention, exact grace boundary, expiry history/webhooks, and cancellation webhook event identity/timestamp. Unit tests, race tests and vet pass locally.

Safety

No production HTTP/runtime wiring yet. Existing v3 behavior and PocketBase runtime are untouched.