Complete Payment module: initiate/webhook/confirm/refund actions, Filament resources (T5.8-T5.13)

- InitiatePaymentAction + POST /api/v1/payments/{booking}/initiate
- Generic KBZ webhook (POST /api/v1/webhooks/{method}/{encryptBookingId?}),
  signature verification per KBZ's real callback spec, PaymentGatewayInterface::handleWebhook()
- ConfirmPaymentAction: idempotent confirmation, PaymentCompleted/PaymentFailed events,
  MarkBookingPaid listener
- RefundBookingAction + POST /api/v1/bookings/{booking}/refund: partial refunds validated
  against remaining balance, RefundProcessed event, MarkBookingRefunded listener
- CancelBookingAction now refunds confirmed bookings instead of rejecting; BookingPolicy::cancel
  requires process_refunds for confirmed bookings
- PaymentPlugin + PaymentResource/RefundResource Filament admin UI (read-only payments,
  refund list + Process action)
- Booking detail page now shows related payments
- Fix CACHE_STORE mismatch (database -> redis) so tagged route caching works
- CLAUDE.md: never run migrate:fresh/migrate:refresh/db:wipe on dev without being asked

app-modules/payment/src/Contracts/PaymentGatewayInterface.php

@@ -5,6 +5,7 @@ namespace Modules\Payment\Contracts;
 use Modules\Payment\Data\PaymentRequestData;
 use Modules\Payment\Data\PaymentResultData;
 use Modules\Payment\Data\RefundResultData;
+use Modules\Payment\Exceptions\InvalidWebhookSignatureException;
 
 /**
  * Contract every payment gateway strategy implements (e.g. KbzMiniAppGateway).
@@ -30,4 +31,18 @@ interface PaymentGatewayInterface
      * Reverse (all or part of) a successful payment.
      */
     public function refund(string $gatewayTransactionId, string $amount, string $reason): RefundResultData;
+
+    /**
+     * Handle an inbound webhook notification — verifies the payload is
+     * genuinely from the gateway (throwing InvalidWebhookSignatureException
+     * if not) and maps it to a PaymentResultData. Every gateway implements
+     * this itself since the notification shape and signing scheme are
+     * gateway-specific; the webhook controller only routes by PaymentMethod
+     * and never branches on gateway (domain.md §6).
+     *
+     * @param  array<string, mixed>  $payload  The raw, as-posted webhook body.
+     *
+     * @throws InvalidWebhookSignatureException
+     */
+    public function handleWebhook(array $payload): PaymentResultData;
 }