feat(payments): VK Votes payment rail

Wire the VK Mini Apps ("голоса") rail end to end, reusing the intake engine. The
wallet.order endpoint branches by rail: a VK context opens a pending order
(provider vk) and returns its id, which the client passes to VKWebAppShowOrderBox.
VK's two-phase payment callback is verified at the gateway with the app protected
key (GATEWAY_VK_APP_SECRET) and proxied to a backend intake handler: get_item
returns the ordered pack's title and vote price; a chargeable order_status_change
credits the vk segment exactly once (the same Fund, idempotent on VK's own order
id) and records a succeeded event, so the dispatcher push refreshes the wallet.
Integration test for the VK order->credit path.

gateway/internal/backendclient/api.go

@@ -428,6 +428,16 @@ func (c *Client) RobokassaResult(ctx context.Context, params map[string]string)
 	return out.Response, err
 }
 
+// VKCallback forwards a gateway-verified VK payment callback's parameters to the backend intake and
+// returns the backend's raw VK response envelope (`{"response":…}` or `{"error":…}`) for the gateway
+// to relay to VK verbatim. The backend answers 200 in every case (VK's protocol), so a transport
+// error here is a genuine proxy failure.
+func (c *Client) VKCallback(ctx context.Context, params map[string]string) (json.RawMessage, error) {
+	var out json.RawMessage
+	err := c.do(ctx, http.MethodPost, "/api/v1/internal/payments/vk/callback", "", "", params, &out)
+	return out, err
+}
+
 // CatalogAtomResp is one atom line of a storefront product: the value type it grants and quantity.
 type CatalogAtomResp struct {
 	AtomType string `json:"atom_type"`