v4: expose merchant payment HTTP API

[Phloraxx]

Scope

Tenth stacked PayGate v4 implementation slice. Depends on PR #51.

Implements

• standalone standard-library net/http merchant API; still not registered into the production v3 server
• POST /v1/payments, GET /v1/payments/{id}, POST /v1/payments/{id}/cancel
• Bearer merchant API-key authentication through the v4 auth service
• stable merchant-level idempotency scope so API-key rotation does not turn a retry into a duplicate payment
• strict JSON decoding with unknown-field rejection, body-size cap and required JSON content type
• create request exposes only whole-INR amount, person/payee name, non-unique event external_id, optional metadata and Idempotency-Key
• explicitly rejects old/internal fields such as paymentAccount
• fixed-decimal string monetary responses, canonical upi_uri, lifecycle timestamps and status
• no collection-profile/parser/relay fields leak to the merchant response
• paid responses return actual payer name/UPI ID/paid_at separately from merchant-supplied name
• concise public error codes without database/internal error leakage

Tests

Covers authenticated creation, canonical UPI URI, no routing leakage, exact replay/conflict, idempotency across API-key rotation, non-unique event IDs, get/cancel/idempotent cancel, missing/revoked auth, rejected paymentAccount, missing idempotency key, fractional/trailing JSON rejection, 404s, and paid payer-identity response. Full internal/v4/... unit tests, race tests, vet and diff checks pass locally.

Safety

No production route registration, no PocketBase changes and no frontend cutover yet.