No API versioning (`/v1`) — breaking changes have no migration path

[Darkdruce]

Summary

Routes are unversioned (/payments, /merchants), so any breaking change affects all clients at once.

Location

• src/api/mod.rs:50-82

Details & impact

A payment API needs a stable contract; without versioning there's no way to evolve request/response shapes without breaking integrators.

Suggested fix

Introduce a /v1 prefix and a documented deprecation policy.

Acceptance criteria

• Public routes are versioned.