Issue #3609923: Standardize the payment lifecycle (authorized/captured/cancelled) and record checkout authorizations instead of capturing inline

Standardizes the payment state machine onto the usual card lifecycle and moves the checkout capture off the request path, fixing the transient capture race.

States collapse to one "money taken" state: paid is removed (everything captured is captured), held becomes authorized, released becomes cancelled. The deposit record kind hold becomes deposit.

Methods become one standard verb set on PaymentManager: authorize() (records an existing pending payment as authorized), capture() (captures an authorized payment via the gateway, or records a completed direct sale), cancel(), refund() (now acts on a captured payment), fail(), plus the authorizeToken() and chargeToken() factories. The gateway plugin's release() becomes cancel().

Finalizer: WorldlinePaymentFinalizer no longer captures the checkout inline (that best-effort capture raced the authorization and reported the payment taken while the money never moved). A PENDING_MERCHANT checkout is recorded authorized; a COMPLETED checkout is recorded captured. The deferred capture is left to the consumer (a workflow settle step) where it can wait and retry. Only a still-pending checkout is processed, so multiple, duplicate or out-of-order webhooks are idempotent.

Pre-1.0: the state values are renamed outright, no back-compat shim. Kernel tests (incl. the authorized finalizer path and webhook multi-delivery), phpcs and phpstan are green.