fix: #3610530 Distinguish a payer-cancelled checkout from a failed payment: record it Cancelled, not Failed

When a payer cancelled the Worldline hosted checkout, kessai recorded the payment Failed, indistinguishable from a real problem (a decline, an error, an amount mismatch), and the finalizer's not-accepted branch failed it silently (no log).

Fix

• PaymentManager::cancelPending(): the counterpart to fail() for a pending payment the payer cancelled, a locked PENDING -> CANCELLED transition announcing CANCELLED, no gateway call, reusing the existing CANCELLED state.
• WorldlineGateway::paymentCancelledByConsumer(): a cancelled checkout is a created payment in the CANCELLED status; a decline is REJECTED.
• The finalizer records a consumer cancellation cancelled and everything else (declined, ambiguous, no created payment) failed, and logs the outcome either way.

Tests

PaymentManagerTest (cancelPending: records CANCELLED, idempotent, never overrides a captured payment) and WorldlineFinalizerTest (cancelled checkout -> CANCELLED, declined -> FAILED). Full kessai + kessai_worldline kernel suites pass.

Kessai-only; routing a cancellation differently in a workflow consumer is a separate follow-up.