v4: expose relay pairing events and heartbeat

[Phloraxx]

Scope

Fifteenth stacked PayGate v4 implementation slice. Depends on PR #56.

Implements

• public v4 relay HTTP boundary for QR/App-Link pairing token consumption, signed notification events and signed heartbeat
• keeps existing Android signature header names to minimize app migration churn
• one-time pairing token is sent in the POST body, not query string; relay endpoints reject query parameters
• signed heartbeat is provider-agnostic and cannot mutate payment state
• heartbeat persists app/device version plus notification access, listener, battery/background/foreground-service and local queue health
• Overview connection state prefers heartbeat/event freshness and is considered connected only within a one-hour freshness window
• active-device Settings expose the latest health snapshot
• SQLite schema migration v2 adds relay-health columns and upgrades existing v1 databases in place
• heartbeat update fails if the device is revoked between signature verification and persistence
• event ingestion continues to use the fail-closed Paytm/Kotak parser/matcher already merged

Tests

Covers v1→v2 SQLite migration, QR token enrollment through HTTP, signed heartbeat persistence, device-health readback, signed notification request, invalid signature and query-parameter rejection. Full internal/v4/... unit tests, race tests, vet and diff checks pass locally.

Safety

No production route registration or Android rollout yet. V3 relay endpoints remain untouched.