Issue #3609198: Settle or fail a parked payment step by hand from the instance trace

Adds "Mark payment paid" and "Mark payment failed" operations to a parked payment token on the instance trace, through hook_orchestra_ui_token_operations_alter.

Marking paid settles the payment at the manager (the same settlement a verified gateway callback ultimately performs), so the settlement bridge resumes the pinned step and the run advances. It does not go through a gateway webhook or finalizer, so it is gateway-agnostic and reproduces the outcome, not the callback. Marking failed leaves the step parked for a retry. Gated on administer orchestra, CSRF-protected.

The pinned-payment lookup is extracted into a shared PinnedPayment service, used by the operations, their controller and the payment interaction (which previously carried its own copy).

Covered by PaymentOperationsTest (operations appear only for an in-flight payment; marking paid settles and resumes; marking failed stays parked). PaymentBridgeTest still green after the interaction refactor. Payment doc and French translations updated.

Closes #3609198.