feat(payments): add a paged list endpoint for payments

[tiana-code]

E-08 #289a (F-08.7a) - the backend half of the payments UI slice. The PaymentController had no list endpoint (only POST initiate, GET /{id}, POST /{id}/cancel), so the payments dashboard screen (#289b) needs one.

What

• GET /v1/payments?page=&size= returning PageResponse<PaymentResponse> newest-first, mirroring the merged ledger accounts list:
  • PaymentService.list(page, size): PaymentPage + @Transactional(readOnly = true) impl using PageRequest.of(page, size, Sort desc createdAt, desc id) + findAll + adapter::toDomain.
  • new generic PageResponse<T> DTO + PaymentPage application wrapper + PaymentApiMapper.toPageResponse.
  • thin controller method: bounds page >= 0 and size in 1..100 (MAX_PAGE_SIZE) -> 400 via the existing IllegalArgumentException handler, then delegates.
• Reuses the existing GET /v1/payments/** -> payments:read rule (covers the collection); no SecurityConfig change.

Gate chain

• critic: GO (faithful mirror of the ledger accounts list).
• security-auditor (opus): PASS - GET requires payments:read (401 tested), size bounded (no unbounded/DoS), response is PaymentResponse only (no PII/internal leak), readOnly tx with no external call, §5.3 clean, 4/4 ACs.
• code-reviewer: APPROVED, no must-fix - PaymentEntity has createdAt+id for the sort (no PropertyReferenceException), thin controller, MAX_PAGE_SIZE const, SPDX. Adopted the one LOW: the IT now asserts newest-first ordering.
• evaluator: PASS (0.88+).
  Local gates green: test/detekt/detektTest/spotlessCheck/assemble/compileIntegrationTestKotlin.

Part of #289 (the payments UI #289b follows on this endpoint).