Issue #3622615: Follow kessai's renames, and let the payment give the handoff link

Implements #3622615.

Three call sites follow kessai #3621923, which takes the card out of the engine's vocabulary and shapes what is left by audience:

Was	Is
$payment->setStoreCard(...)->setCardValidUntil(...)	setStoreToken() / setTokenValidUntil()
$this->paymentManager->deleteStoredCard($payments)	deleteStoredTokens()
PaymentHandoffController::getHandoffUrl($payment, $url)	$payment->getHandoffUrl($url)

The third is not only a rename. Where to send a payer to begin a payment is a question about that payment, so kessai's payment answers it rather than a static on an HTTP controller this module had to import.

orchestra's own card words are deliberately untouched: Payable::$storeCard, Payable::$cardValidUntil and PayableResolverInterface are read by every payable resolver outside this project, and kessai's rename does not reach them.

CI will be red until kessai lands, and that is the point

This calls four methods that exist only on kessai's 3621923 branch. The pipeline installs kessai from its released alpha, so phpstan and phpunit cannot resolve them. The three merge requests have to land together — kessai !68 (merged), this, and yoyaku #3622616 — and kessai's two renamed base fields mean the site is reinstalled when they do.

Verified here instead: phpcs at the templates' own ruleset is clean over the whole module, and each of the four names was checked against its declaration on kessai's branch.

AI-Generated: Yes (Claude Code was used to help write this change and its merge request description. I reviewed and ran the work myself before posting it.)