fix(payments): complete PR #365 Redsys remediation

[agustinjch]

Purpose

Apply the reviewed Redsys remediation directly onto the current head branch of #365.

This branch is based on 07e985a, the latest #365 head at reconciliation time, and contains four commits. It replaces the overlapping non-atomic finalizer/return implementation with the verified atomic payment finalizer and capability-bound return relay, then applies the remaining security and provider-contract corrections.

Included

• No deposit or confirmation before verified authorization.
• Atomic, idempotent callback finalization under concurrency and rollback.
• Recoverable full-page booking return without React memory or browser storage.
• Compact provider return relay within the 250-character Redsys limit.
• Fail-closed credential handling and encrypted per-property signing keys.
• Currency-aware minor units, amount-bearing void, and signed operation-bound REST responses.
• Alias-safe secret masking and deployment backfill instructions.
• PostgreSQL callback/credential tests enabled in CI and refreshed tracked test counts.

Verification

• Real EUR sandbox authorization and cancellation were verified before the final security wave.
• Exact signed callback replay was idempotent.
• Final tracked-tree run: 2,392 passing tests across 280 files.
• Reconciled current-head checks: API 167, booking 61, dashboard 160; build, typecheck, lint, and diff checks passed.
• Independent scoped review: all blockers addressed, no new breakage.

Deployment prerequisite

Provision the protected-credential key ring and run the documented idempotent Redsys credential backfill before enabling payment traffic. Apply migrations 0024–0026 before the API/widget rollout.

Closes no issue. The optional embedded inSite follow-up is tracked separately in #366.

[agustinjch]

PR #365 now contains the reconciled four-commit remediation directly, with an identical reviewed tree and green CI. Closing this helper as obsolete.