feat(web): add a payment initiation form to the payments screen

[tiana-code]

E-08 Sandbox UI #299 (289c) - payment initiation form (follow-up to the payments list #289b). Reuses the #297 write-UI pattern.

What

• api/client.ts: apiPost extended to (path, {body?, headers?}) - sends a JSON body + custom headers, dev-bearer stays authoritative; backward-compatible (the case-actions apiPost(path) call is unchanged).
• features/payments/useInitiatePayment.ts: useMutation POST /v1/payments with the body + an Idempotency-Key header; onSuccess invalidates the payments query.
• features/payments/PaymentForm.tsx: amount / currency (select over USD/EUR/GBP) / reference (maxLength 140) inputs; Create disabled until amount > 0 and reference non-blank (mirrors the backend @DecimalMin/@NotBlank/@SiZe).
• routes/Payments.tsx: a "New payment" toggle, the form, an error alert, and a reset on toggle.
• 3 vitest tests: POST asserts method + JSON-number amount body + Idempotency-Key header present + list refetch; Create stays disabled until valid; failure surfaces the alert.

Idempotency (money-path)

The Idempotency-Key is generated per user intent at the mutate() call and passed into the mutation, so a retry of the same submit reuses the key and the backend dedupes it - an accidental retry is not a second payment. (code-reviewer MEDIUM, applied.)

Gate chain

• critic: GO-WITH-CHANGES (reference maxLength 140; apiPost header-merge dev-bearer authoritative; test asserts POST + JSON-number + Idempotency-Key presence + refetch - all applied).
• security-auditor (opus): PASS - idempotency per-submit, authz server-side (payments:write; UI does not self-authorize), header merge safe, constrained inputs, no secrets, clean-room clean.
• code-reviewer: 1 MEDIUM (idempotency-key lifetime) applied; header-merge/204/amount-string declined with rationale (auditor-confirmed safe / YAGNI / matches the codebase number convention).
• evaluator: PASS (0.88).
  Web gates green: lint 0 errors, typecheck, vitest 63 passed (3 new), build.

Closes #299