Complete Payment module: initiate/webhook/confirm/refund actions, Filament resources (T5.8-T5.13)

- InitiatePaymentAction + POST /api/v1/payments/{booking}/initiate
- Generic KBZ webhook (POST /api/v1/webhooks/{method}/{encryptBookingId?}),
  signature verification per KBZ's real callback spec, PaymentGatewayInterface::handleWebhook()
- ConfirmPaymentAction: idempotent confirmation, PaymentCompleted/PaymentFailed events,
  MarkBookingPaid listener
- RefundBookingAction + POST /api/v1/bookings/{booking}/refund: partial refunds validated
  against remaining balance, RefundProcessed event, MarkBookingRefunded listener
- CancelBookingAction now refunds confirmed bookings instead of rejecting; BookingPolicy::cancel
  requires process_refunds for confirmed bookings
- PaymentPlugin + PaymentResource/RefundResource Filament admin UI (read-only payments,
  refund list + Process action)
- Booking detail page now shows related payments
- Fix CACHE_STORE mismatch (database -> redis) so tagged route caching works
- CLAUDE.md: never run migrate:fresh/migrate:refresh/db:wipe on dev without being asked

app-modules/payment/tests/Feature/PaymentResourceTest.php

@@ -0,0 +1,80 @@
+<?php
+
+use App\Models\User;
+use Livewire\Livewire;
+use Modules\Booking\Models\Booking;
+use Modules\Payment\Enums\PaymentMethod;
+use Modules\Payment\Enums\PaymentStatus;
+use Modules\Payment\Filament\Resources\Payments\Pages\ListPayments;
+use Modules\Payment\Filament\Resources\Payments\Pages\ViewPayment;
+use Modules\Payment\Models\Payment;
+use Spatie\Permission\Models\Permission;
+
+beforeEach(function () {
+    foreach (['view_payments', 'process_refunds'] as $permission) {
+        Permission::findOrCreate($permission, 'web');
+    }
+});
+
+test('a user with view_payments can list payments', function () {
+    $viewer = User::factory()->create()->givePermissionTo('view_payments');
+    $this->actingAs($viewer);
+
+    $payments = Payment::factory()->count(3)->create();
+
+    Livewire::test(ListPayments::class)
+        ->assertOk()
+        ->assertCanSeeTableRecords($payments);
+});
+
+test('can filter payments by status', function () {
+    $viewer = User::factory()->create()->givePermissionTo('view_payments');
+    $this->actingAs($viewer);
+
+    $pending = Payment::factory()->create(['status' => PaymentStatus::Pending]);
+    $completed = Payment::factory()->completed()->create();
+
+    Livewire::test(ListPayments::class)
+        ->filterTable('status', PaymentStatus::Completed->value)
+        ->assertCanSeeTableRecords([$completed])
+        ->assertCanNotSeeTableRecords([$pending]);
+});
+
+test('can view a payment\'s detail page', function () {
+    $viewer = User::factory()->create()->givePermissionTo('view_payments');
+    $this->actingAs($viewer);
+
+    $booking = Booking::factory()->create();
+    $payment = Payment::factory()->create([
+        'booking_id' => $booking->id,
+        'gateway' => PaymentMethod::KbzMiniApp,
+        'gateway_transaction_id' => 'EVB-VIEWTEST-1',
+    ]);
+
+    Livewire::test(ViewPayment::class, ['record' => $payment->getRouteKey()])
+        ->assertOk()
+        ->assertSee($booking->booking_ref)
+        ->assertSee('EVB-VIEWTEST-1');
+});
+
+test('the gateway response is visible to a user with process_refunds', function () {
+    $admin = User::factory()->create()->givePermissionTo(['view_payments', 'process_refunds']);
+    $this->actingAs($admin);
+
+    $payment = Payment::factory()->create(['gateway_payload' => ['prepay_id' => 'PREPAY-SECRET-123']]);
+
+    Livewire::test(ViewPayment::class, ['record' => $payment->getRouteKey()])
+        ->assertOk()
+        ->assertSee('PREPAY-SECRET-123');
+});
+
+test('the gateway response is hidden from a user without process_refunds', function () {
+    $support = User::factory()->create()->givePermissionTo('view_payments');
+    $this->actingAs($support);
+
+    $payment = Payment::factory()->create(['gateway_payload' => ['prepay_id' => 'PREPAY-SECRET-123']]);
+
+    Livewire::test(ViewPayment::class, ['record' => $payment->getRouteKey()])
+        ->assertOk()
+        ->assertDontSee('PREPAY-SECRET-123');
+});