feat(gateway): the Robokassa /pay/ edge routes

Add the public /pay/robokassa/result callback proxy (rate-limited; forwards the
provider's form parameters to the backend intake, the single writer, and echoes
its "OK<InvId>" back to Robokassa) and the /pay/robokassa/{success,fail}
browser-return redirects into the app. Route /pay/* to the gateway in the
contour Caddyfile so the callback reaches the edge, not the landing catch-all.
The backend intake now returns the echo body as JSON for the gateway to relay.

backend/internal/server/handlers_intake.go

@@ -121,5 +121,6 @@ func (s *Server) handleRobokassaResult(c *gin.Context) {
 			s.log.Error("record payment event failed", zap.String("order", orderID.String()), zap.Error(err))
 		}
 	}
-	c.String(http.StatusOK, "OK"+v.Get("InvId"))
+	// The gateway echoes response verbatim to Robokassa, which requires the body "OK<InvId>".
+	c.JSON(http.StatusOK, gin.H{"response": "OK" + v.Get("InvId")})
 }