feat(sandbox): add the payments service to docker-compose

[tiana-code]

Adds the payments service to the local sandbox compose stack (E-06, #238).

What

• Parameterize the root Dockerfile with ARG SERVICE=ledger so the same multi-stage build produces either service jar. Default ledger keeps the ledger build and the docker image CI job unchanged.
• Add a payments service to docker-compose.yml on host port 8081, pointing at its own payments database, depends_on postgres healthy, with the sandbox bank provider enabled (FINCORE_PAYMENTS_BANK_SANDBOX_ENABLED=true) so it boots without a real adapter.
• Create the second database via a postgres initdb script (scripts/initdb/01-create-payments-db.sql) so each service keeps an isolated Liquibase DATABASECHANGELOG/lock.
• Genericize scripts/demo.sh wording so it smoke-checks any base URL (behaviour identical for ledger).
• compose-smoke CI job now polls both 8080 (ledger) and 8081 (payments), preserving the load-bearing step order.

Notes

• The webhook HMAC secret is intentionally omitted; PaymentWebhookProperties defaults to a blank fail-closed secret, so payments boots fine and no weak secret is committed.
• Docker is unavailable in WSL, so local docker compose config could not run. The CI Compose smoke job is the binding verification: payments must come up on 8081.

Gate chain

• security-auditor (opus): PASS, no must-fix.
• evaluator: PASS (0.876 >= 0.80).
• code-reviewer findings were out-of-scope (referenced .kt files not in this infra-only diff) and rejected.

Closes #238