v4: add operator payment management

[Phloraxx]

Scope

Eleventh stacked PayGate v4 implementation slice. Depends on PR #52.

Implements

• payment-centric operator service replacing Review/Reconciliation as a primary workflow
• searchable/filterable payment list by payment ID, event external_id, merchant name, payer identity, amount, status and profile
• non-unique event IDs remain valid and searchable
• complete payment detail with payment history and webhook-delivery timeline
• deterministic timeline ordering even when entries share the same millisecond
• direct operator edits for mutable business fields: name, external_id, metadata, payer name/UPI, internal note and status
• preserves immutable payment identity: requested/payable amount, collection-profile snapshot, UPI destination and creation identity are not editable
• status correction to paid records paid_at, payment history and durable webhook atomically
• private-note-only edits are audited but do not emit merchant webhooks
• no-op edits are idempotent
• reopening to pending is refused after the exact amount reservation has been released/reused; old payments may still be corrected to paid
• edits inside the protected reservation window can safely return a payment to pending

Tests

Covers search/filter including SQL wildcard escaping, duplicate event IDs, detail/history/webhooks, editable-field updates, immutable identity preservation, private-note behavior, paid correction, no-op idempotency, unsafe reopen after release and protected-window reopen. Full internal/v4/... unit tests, race tests, vet and diff checks pass locally.

Safety

No production route registration or UI cutover yet. Operator management remains an isolated v4 service.