feat(payments): payment-event dispatcher + the provider-return UX

Deliver payment_events to connected clients as an in-app wallet-refresh push: a
background dispatcher drains undispatched events and publishes a KindNotification
"payment" signal, marking each delivered; the client bumps a wallet-refresh
counter the open Wallet screen watches, re-fetching in place. A return-focus
refetch is the fallback. The Robokassa Success/Fail return now serves a
self-closing page (the payment opens in a separate window) so the customer drops
back into the live app instead of a cold start. Integration test for the event
drain/mark queue.

PLAN.md

@@ -515,8 +515,11 @@ chargeback **never drives the balance negative** (D27 stands, `balances_chips_ch
 the offer page (`/offer/`), the order/`fund` engine (idempotent, honours an expired order), the
 `internal/robokassa` adapter, the `POST /wallet/order` + internal Result-callback handlers (a D36
 confirmed-email gate on `direct`), the pending reaper, the `wallet.order` edge wire + the public
-`/pay/*` routes, the Wallet purchase CTA, and the contour deploy env (IsTest forced). Remaining:
-the `payment_events` dispatcher (delivery), then the VK and TG-Stars rails and refunds.
+`/pay/*` routes, the Wallet purchase CTA, the contour deploy env (IsTest forced), and the
+`payment_events` dispatcher — an in-app wallet-refresh push (KindNotification `"payment"`) with a
+self-closing provider-return page (the payment opens in a separate window) and a return-focus
+refetch fallback. Remaining: the VK and TG-Stars rails and refunds; and hiding the ad banner on a
+no-ads purchase (a spend-path `NotifyBanner`, deferred with the owner's agreement).
 
 **Goal.** Accept real money on all three rails into the payments domain: order-flow,
 verified provider callbacks, idempotency, the TG bot SQLite outbox, the event dispatcher,