feat(payments): VK Votes payment rail

Wire the VK Mini Apps ("голоса") rail end to end, reusing the intake engine. The
wallet.order endpoint branches by rail: a VK context opens a pending order
(provider vk) and returns its id, which the client passes to VKWebAppShowOrderBox.
VK's two-phase payment callback is verified at the gateway with the app protected
key (GATEWAY_VK_APP_SECRET) and proxied to a backend intake handler: get_item
returns the ordered pack's title and vote price; a chargeable order_status_change
credits the vk segment exactly once (the same Fund, idempotent on VK's own order
id) and records a succeeded event, so the dispatcher push refreshes the wallet.
Integration test for the VK order->credit path.

PLAN.md

@@ -518,8 +518,13 @@ confirmed-email gate on `direct`), the pending reaper, the `wallet.order` edge w
 `/pay/*` routes, the Wallet purchase CTA, the contour deploy env (IsTest forced), and the
 `payment_events` dispatcher — an in-app wallet-refresh push (KindNotification `"payment"`) with a
 self-closing provider-return page (the payment opens in a separate window) and a return-focus
-refetch fallback. Remaining: the VK and TG-Stars rails and refunds; and hiding the ad banner on a
-no-ads purchase (a spend-path `NotifyBanner`, deferred with the owner's agreement).
+refetch fallback. The **VK Votes rail** is delivered too: the client opens
+`VKWebAppShowOrderBox({item: order_id})`; a two-phase signed server callback (`get_item` → the pack
+title + vote price; a chargeable `order_status_change` → the same `Fund` with source=`vk`, idempotent
+on VK's own order id) is verified at the gateway with the app protected key (`GATEWAY_VK_APP_SECRET`,
+already deployed) and proxied to the backend intake. Remaining: the TG-Stars rail and refunds; and
+hiding the ad banner on a no-ads purchase (a spend-path `NotifyBanner`, deferred with the owner's
+agreement).
 
 **Goal.** Accept real money on all three rails into the payments domain: order-flow,
 verified provider callbacks, idempotency, the TG bot SQLite outbox, the event dispatcher,