Add Payment module: contracts, payments/refunds tables, KBZ gateway, factory, orchestrator (T5.1-T5.7)

- T5.1 PaymentGatewayInterface, DTOs, PaymentMethod/PaymentStatus/RefundStatus enums
- T5.2 payments/refunds tables, models, factories
- T5.3-T5.5 KbzMiniAppGateway: initiate()/verify()/refund(), ported KBZ signing scheme,
  wired refund_amount through for partial refunds, mTLS options for refund
- T5.6 PaymentGatewayFactory resolving gateways by PaymentMethod
- T5.7 PaymentService orchestrator delegating to the resolved gateway

app-modules/payment/src/Contracts/PaymentGatewayInterface.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace Modules\Payment\Contracts;
+
+use Modules\Payment\Data\PaymentRequestData;
+use Modules\Payment\Data\PaymentResultData;
+use Modules\Payment\Data\RefundResultData;
+
+/**
+ * Contract every payment gateway strategy implements (e.g. KbzMiniAppGateway).
+ *
+ * Strategies are deliberately ignorant of Payment/Booking Eloquent models —
+ * they only take/return DTOs, so booking-status changes stay in listeners
+ * reacting to PaymentCompleted/PaymentFailed/RefundProcessed (domain.md §6).
+ */
+interface PaymentGatewayInterface
+{
+    /**
+     * Start a payment attempt with the gateway.
+     */
+    public function initiate(PaymentRequestData $data): PaymentResultData;
+
+    /**
+     * Re-check a payment's current status with the gateway (defense-in-depth
+     * re-verification, and used inside webhook processing — domain.md §6).
+     */
+    public function verify(string $gatewayTransactionId): PaymentResultData;
+
+    /**
+     * Reverse (all or part of) a successful payment.
+     */
+    public function refund(string $gatewayTransactionId, string $amount, string $reason): RefundResultData;
+}