v4: add standalone direct-SQLite runtime

[Phloraxx]

Scope

Sixteenth stacked PayGate v4 implementation slice. Depends on PR #57.

Implements

• standalone cmd/paygate-v4 process with no PocketBase runtime dependency
• fail-closed single-process lock before opening SQLite
• direct SQLite runtime wiring for merchant, admin and relay HTTP surfaces
• password bootstrap required only for a fresh v4 database; existing credential state is never replaced from env
• persisted webhook settings loaded at startup
• payment-expiry worker plus durable webhook worker
• /health endpoint with live SQLite check
• explicit CORS allowlist for the separate test frontend
• graceful SIGINT/SIGTERM HTTP shutdown
• native SQLite Online Backup API inside the one PayGate process
• backup integrity + foreign-key verification, fsync, 0600 permissions and atomic no-overwrite publish
• daily UTC backup worker with bounded retention
• correct QR/App-Link composition (/device/pair/<token>) separate from the relay pairing API

Tests / validation

• fresh-bootstrap refusal and successful bootstrap
• exclusive process-lock ownership
• health, CORS and Android admin login through assembled router
• real merchant payment creation proving routing remains server-owned
• worker-driven payment expiry
• verified backup readability and bounded retention
• live-database/existing-destination backup refusal
• QR/App-Link runtime composition
• full internal/v4/... unit tests, race tests, vet and git diff --check
• go build ./cmd/paygate-v4
• go list -deps ./cmd/paygate-v4 confirms no github.com/pocketbase/pocketbase dependency

Safety

This adds a separate v4 binary only. It is not deployed, does not replace the v3 PocketBase process, and does not migrate production data.