PayGate v3 foundation and operator platform

[Phloraxx]

Final scope

This branch is the canonical PayGate v3 API/operator platform now running in production.

It includes the v2 reliability foundation plus the reconciled v3 operator/admin product: typed evidence and operator boundaries, relay power-health readiness, exact matcher invariants, aggregate alert semantics, full-history payment search/filter/sort/pagination, audited operator-owned payment profile edits, strict protection of financial/evidence/create identity, and the simplified Overview / Payments / Action / Health / More admin UI.

Safety invariants

• integer paise and exact amount/account matching
• unique evidence/reference guards and stale-evidence rejection
• fail closed on ambiguous or reused evidence
• payment/outbox mutations remain atomic
• historical exhausted webhooks are not replayed
• SQLite remains single-writer
• externalId, original metadata, idempotency identity, amount/account/status/RRN/evidence remain non-editable through profile updates
• unknown/protected edit keys fail with HTTP 400

Validation and rollout

Final head 67bcc8f5e2d178aca251bc0dc26f72b1326909dd has GitHub CI run #143 fully green: frontend audit/typecheck/build, Go formatting and whitespace checks, Go tests, full race tests, vet, staticcheck, govulncheck, and production container build.

The same exact tree is currently deployed as immutable image main-payment-17aqux:v3-67bcc8f5 and has passed production DB/connector/relay/checkout health gates, a fresh verified backup + restore drill, operational cron soak, and direct-rail unpaid create/status/cancel smoke tests.

Merging this PR makes main match the already validated/deployed source tree; it does not change the running pinned production image.