Issue #3609941: Support authorize-then-capture in the settle step, and purge an instance's pinned payments on delete

Follow-up to kessai #3609923 (merged): wires orchestra_payment to the new authorize/capture lifecycle so a reserve-first checkout is captured off the request path, and purges an instance's payments on delete.

• PaymentWorkflowBridge wakes the parked payment step on authorized (a reserve-first checkout advances the run before the capture) and captured (a direct sale), guarded to a pinned KIND_PAYMENT so a deposit authorization never wakes it.
• SettleTask captures the instance's authorized checkout through the engine's retry (a transient gateway race retries, then raises an incident once attempts are spent; a permanent refusal records a declined outcome), passes through an already-captured direct sale, and adds a cancel_when_zero option so a zero-amount authorization can be kept as a standing pre-authorization.
• PaymentInteraction treats a pinned authorized/captured checkout as done for the step.
• New InstancePaymentCleanup: deleting a process instance deletes the checkout payments pinned to its tokens (local rows are operational mirrors; the provider back office keeps the record). Only token-pinned checkout payments; a deposit is scoped to its order.

Adopts the renamed kessai states/methods throughout; docs and fr.po updated. Kernel suite green (21 tests).

Depends on the kessai lifecycle change being available (kessai 1.x-dev).