feat(payments): VK Votes payment rail

Wire the VK Mini Apps ("голоса") rail end to end, reusing the intake engine. The
wallet.order endpoint branches by rail: a VK context opens a pending order
(provider vk) and returns its id, which the client passes to VKWebAppShowOrderBox.
VK's two-phase payment callback is verified at the gateway with the app protected
key (GATEWAY_VK_APP_SECRET) and proxied to a backend intake handler: get_item
returns the ordered pack's title and vote price; a chargeable order_status_change
credits the vk segment exactly once (the same Fund, idempotent on VK's own order
id) and records a succeeded event, so the dispatcher push refreshes the wallet.
Integration test for the VK order->credit path.

ui/src/lib/vk.ts

@@ -182,6 +182,21 @@ export async function vkShowImages(url: string): Promise<boolean> {
   }
 }
 
+/**
+ * vkShowOrderBox opens VK's payment box for a "голоса" item purchase; item is the order id the
+ * backend created (VK echoes it to our payment callback, which credits). Resolves true when the
+ * payment completes, false on cancel/failure or outside VK. The chips are credited by the server
+ * callback, so the wallet refreshes from the payment push regardless of this result.
+ */
+export async function vkShowOrderBox(item: string): Promise<boolean> {
+  try {
+    await (await bridge()).send('VKWebAppShowOrderBox', { type: 'item', item });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * vkDownloadFile downloads url as filename through the VK client (VKWebAppDownloadFile) —
  * the mobile in-app file delivery, where the webview ignores <a download>. Resolves false