Add Access group admin surfaces, booking soft deletes, refund crash fix

Access group (Filament):
- StaffResource: manage users with an admin-tier role, gated by manage_staff
- CustomerResource: read-only view of role-less users, gated by view_customers
- RoleResource: edit permissions per role (fixed role set), gated by manage_roles
- ManageAppSettings: tabbed General/Booking settings page that reads/writes
  real .env keys via new EnvFileWriter (no parallel DB settings table, so
  BookingService/config('booking.*') stay unchanged)
- Moved Access above Catalog in the nav group order
- New permissions: manage_staff, manage_roles, view_customers, manage_settings

Booking soft deletes:
- bookings.deleted_at + SoftDeletes on the Booking model
- BookingPolicy::delete (manage_bookings, cancelled/expired only) and
  ::restore (manage_bookings)
- DeleteBookingTableAction/RestoreBookingTableAction + TrashedFilter on
  BookingsTable, using authorize() so the policy is enforced at call time,
  not just cosmetically hidden

Refund crash fix:
- ProcessRefundAction passed a nullable $payment->booking into
  RefundBookingAction's non-nullable Booking param — a soft-deleted
  booking's payment reaching the refund picker was an uncaught TypeError.
  Excluded such payments from the picker and added a defensive guard.
- Same unguarded $event->payment->booking / $event->refund->payment->booking
  pattern fixed in the MarkBookingPaid/MarkBookingRefunded queued listeners.

289 tests passing.

app-modules/payment/tests/Feature/MarkBookingPaidTest.php

@@ -24,3 +24,12 @@ test('does not touch a booking that already moved on for another reason', functi
 
     expect($booking->refresh()->status)->toBe(BookingStatus::Cancelled);
 });
+
+test('does not crash if the booking was soft-deleted before this queued listener ran', function () {
+    $booking = Booking::factory()->create(['status' => BookingStatus::PendingPayment]);
+    $payment = Payment::factory()->completed()->create(['booking_id' => $booking->id]);
+    $booking->delete();
+
+    expect(fn () => (new MarkBookingPaid)->handle(new PaymentCompleted($payment->fresh())))
+        ->not->toThrow(Throwable::class);
+});

app-modules/payment/tests/Feature/MarkBookingRefundedTest.php

@@ -0,0 +1,40 @@
+<?php
+
+use Modules\Booking\Enums\BookingStatus;
+use Modules\Booking\Models\Booking;
+use Modules\Payment\Enums\PaymentMethod;
+use Modules\Payment\Enums\RefundStatus;
+use Modules\Payment\Events\RefundProcessed;
+use Modules\Payment\Listeners\MarkBookingRefunded;
+use Modules\Payment\Models\Payment;
+use Modules\Payment\Models\Refund;
+
+test('flips a confirmed booking to cancelled', function () {
+    $booking = Booking::factory()->create(['status' => BookingStatus::Confirmed]);
+    $payment = Payment::factory()->completed()->create(['booking_id' => $booking->id, 'gateway' => PaymentMethod::KbzMiniApp]);
+    $refund = Refund::factory()->create(['payment_id' => $payment->id, 'status' => RefundStatus::Completed]);
+
+    (new MarkBookingRefunded)->handle(new RefundProcessed($refund));
+
+    expect($booking->refresh()->status)->toBe(BookingStatus::Cancelled);
+});
+
+test('does not touch a booking that already moved on for another reason', function () {
+    $booking = Booking::factory()->create(['status' => BookingStatus::Cancelled]);
+    $payment = Payment::factory()->completed()->create(['booking_id' => $booking->id, 'gateway' => PaymentMethod::KbzMiniApp]);
+    $refund = Refund::factory()->create(['payment_id' => $payment->id, 'status' => RefundStatus::Completed]);
+
+    (new MarkBookingRefunded)->handle(new RefundProcessed($refund));
+
+    expect($booking->refresh()->status)->toBe(BookingStatus::Cancelled);
+});
+
+test('does not crash if the booking was soft-deleted before this queued listener ran', function () {
+    $booking = Booking::factory()->create(['status' => BookingStatus::Confirmed]);
+    $payment = Payment::factory()->completed()->create(['booking_id' => $booking->id, 'gateway' => PaymentMethod::KbzMiniApp]);
+    $refund = Refund::factory()->create(['payment_id' => $payment->id, 'status' => RefundStatus::Completed]);
+    $booking->delete();
+
+    expect(fn () => (new MarkBookingRefunded)->handle(new RefundProcessed($refund->fresh())))
+        ->not->toThrow(Throwable::class);
+});

app-modules/payment/tests/Feature/RefundResourceTest.php

@@ -124,3 +124,30 @@ test('a non-completed payment is not offered in the process action\'s payment se
 
     expect(Refund::where('payment_id', $pendingPayment->id)->exists())->toBeFalse();
 });
+
+test('a payment whose booking has been soft-deleted is not offered in the process action\'s payment select', function () {
+    $admin = User::factory()->create()->givePermissionTo(['view_payments', 'process_refunds']);
+    $this->actingAs($admin);
+
+    $booking = Booking::factory()->create(['status' => BookingStatus::Cancelled, 'price' => 15000]);
+    $payment = Payment::factory()->completed()->create([
+        'booking_id' => $booking->id,
+        'gateway' => PaymentMethod::KbzMiniApp,
+        'amount' => 15000,
+        'gateway_transaction_id' => 'EVB-FILAMENT-DELETED-1',
+    ]);
+    $booking->delete();
+
+    // Regression: a payment whose booking is gone must never crash the
+    // refund action (RefundBookingAction requires a non-null Booking) — it
+    // simply isn't offered as an option at all.
+    Livewire::test(ListRefunds::class)
+        ->callAction('process', data: [
+            'payment_id' => $payment->id,
+            'amount' => 1000,
+            'reason' => 'reason',
+        ])
+        ->assertHasFormErrors(['payment_id']);
+
+    expect(Refund::where('payment_id', $payment->id)->exists())->toBeFalse();
+});