Add Clean Pay integration APIs

[flake92]

Summary

• add a safe admin user merge workflow for Clean Pay email/Telegram reconciliation
• preserve target data and block only unsafe merges when both accounts have current subscriptions or conflicting identities
• expose authenticated public payment transactions for Clean Pay payment status sync
• route the Telegram cabinet button through the WebApp SSO path

Notes

• Stacked on Add password reset endpoints and clarify WebApp cabinet setup snoups/remnashop#129 (codex/password-reset-webapp-cabinet) so the upstream password reset/WebApp setup PR stays focused.
• The payment webhook and user notifications remain handled by Remnashop; Clean Pay only reads the processed transaction status.

Validation

• uv run --frozen ruff check src
• uv run --frozen mypy src
• uv run --frozen python -m compileall -q src
• docker build -t remnashop:clean-pay-integration-pr-check .
• pytest currently collects 0 tests in this repo