feat(sandbox): drive the full payment lifecycle in the compose smoke

[tiana-code]

F-06.5 (#236) - end-to-end payment lifecycle demo, run in the compose smoke. Unblocked by #315 (Keycloak in the sandbox) and #317 (automatic orchestration after initiate).

What

scripts/demo-payment.sh drives the full journey against the live stack:

1. obtain a client-credentials token from Keycloak (:8085);
2. initiate a payment (POST :8081/v1/payments, bearer + idempotency key, 100.00 USD);
3. poll until it reaches SUBMITTED on its own (this exercises fix(payments): no production trigger advances an initiated payment to SUBMITTED #317's after-commit async orchestration: screening + sandbox-bank submission);
4. deliver an HMAC-signed webhook (X-Webhook-Signature = lowercase hex HMAC-SHA256 over the exact posted body; providerReference reconstructed deterministically as sbx-);
5. poll until the payment settles (SETTLED).

Wires FINCORE_PAYMENTS_WEBHOOK_HMACSECRET into the payments service (compose) and the compose-smoke job; the CI runs the demo after the auth-chain proof. So a regression in orchestration or webhook verification now fails CI - the demo doubles as a regression test (it is exactly what would have caught the #317 defect).

Source-fidelity

• providerReference: SandboxBankProvider returns Accepted("sbx-${paymentId}") and PaymentApiMapper sets id=payment.id.toString(), so sbx-<response.id> equals what the webhook handler matches via findByProviderReference. No DTO change needed.
• HMAC: openssl dgst -sha256 -hmac == python hmac == the server's Mac/%02x (parity verified); the signed bytes equal the posted bytes (--data-binary).
• screening default (amount>=0 APPROVE) approves 100.00, which is neither the sandbox reject (999.99) nor delay (888.88) amount.

Gate chain

critic: initially NO-GO - it correctly caught that the branch was stale (reused a pre-existing branch based on main BEFORE #317 merged, so the orchestration code was absent). Fixed by rebranching from current main; #317 verified present. All other items the critic had already verified. code-reviewer: applied uuidgen portability; -d args already quoted; explicit CI env added. security-auditor (opus): PASS (6/6 ACs, HMAC parity exact, secret wiring matches, webhook permitAll, no publish, clean-room). evaluator: PASS (0.91).

Closes #236