feat(payments): settle the direct rail through YooKassa

Replace Robokassa with YooKassa as the RUB direct-rail provider. The wallet
model is untouched: one `direct` segment, the same spend wall, the same
per-channel merchant shops (D42) and `shop` on the order (D44).

The two providers are not shaped alike, and that drives the change:

- Opening a purchase is now an outbound API call (`POST /v3/payments`,
  single-stage capture, redirect confirmation). The order id is both the
  `Idempotence-Key` and `metadata.order_id`, so a retried create cannot mint a
  second payment and a notification always resolves to its order.
- YooKassa does NOT sign notifications, so the body is never evidence: it only
  names a payment, which is re-read with `GET /v3/payments/{id}`, and only that
  answer is acted on. Two guards ride on it — the payment's metadata must name
  the order, and its `test` flag must match the shop's, so a test-shop payment
  can never credit real chips. The sender address is checked against YooKassa's
  published ranges first, which stops a forger turning each fabricated
  notification into an outbound call of ours.
- A notification lost for good would leave the money taken and the chips unowed,
  silently. The existing pending-order reaper now asks the provider about each
  order that reached its expiry age carrying a payment id, and credits the ones
  really paid — one request per order over its whole life, not polling.
- `payment.canceled` records a `failed` event, so a declined payment is finally
  surfaced to the customer as PAYMENTS.md §9 already specified.
- The admin refund moves the money through `POST /v3/refunds` before recording
  anything; a failed call records nothing, so the ledger cannot claim a refund
  that did not happen, and the recorded id is the provider's own.
- YooKassa has no cabinet-side generic receipt: «Чеки от ЮKassa» registers one
  only if the request carries it, so every payment and refund now sends an
  itemized `receipt` to the D36 confirmed email. The VAT rate code is a deploy
  variable; the settlement subject and method are constants.

Robokassa is retired, not deleted: the direct rail falls back to it when no
YooKassa shop is configured and no deployment sets its credentials, so reviving
it is a credentials change rather than a code change. Its variables are removed
from compose, .env.example, write-prod-env.sh and the three workflows, and
recorded in backend/internal/robokassa/README.md together with the cabinet
configuration and the revival steps. Ledger rows keep `provider = 'robokassa'`;
that literal is load-bearing for the idempotency index.

No migration and no wire change: `orders.provider_payment_id` already existed,
and the client is rail-agnostic.

Decisions D47-D51 (revising D41) and stage E12 are baked into the docs.

backend/internal/config/config.go

@@ -17,6 +17,7 @@ import (
 	"scrabble/backend/internal/robokassa"
 	"scrabble/backend/internal/robot"
 	"scrabble/backend/internal/telemetry"
+	"scrabble/backend/internal/yookassa"
 )
 
 // Config holds the backend's runtime configuration.
@@ -65,8 +66,17 @@ type Config struct {
 	// RendererURL is the base URL of the internal image-render sidecar (e.g.
 	// http://renderer:8090). Empty disables the PNG export artifact.
 	RendererURL string
-	// Robokassa configures the direct-rail (RUB) payment provider — one merchant shop per channel
-	// (D42). An empty set leaves the direct order and Result-callback endpoints unregistered.
+	// YooKassa configures the direct-rail (RUB) payment provider — one merchant shop per channel
+	// (D42). An empty set leaves the direct order and notification endpoints unregistered and falls
+	// the direct rail back to Robokassa.
+	YooKassa yookassa.Shops
+	// YooKassaVatCode is the VAT rate code stamped on every fiscal receipt line (54-ФЗ tag 1199).
+	// It is configurable because the rate is the one receipt attribute that genuinely changes.
+	YooKassaVatCode int
+	// Robokassa configures the retired direct-rail payment provider — one merchant shop per channel
+	// (D42). It is dormant: no deployment sets its credentials, so the set is empty and the rail
+	// resolves to YooKassa. Kept wired so restoring Robokassa is a credentials change, not a code
+	// change — see backend/internal/robokassa/README.md.
 	Robokassa robokassa.Shops
 }
 
@@ -158,9 +168,26 @@ func Load() (Config, error) {
 		AdminTo:   os.Getenv("BACKEND_ADMIN_EMAIL"),
 	}
 
-	// Robokassa direct rail: one merchant shop per channel (D42). The legacy single-shop vars seed
-	// the web channel so existing deploys keep working; the per-channel vars add the rest. A shop
-	// with no MerchantLogin is dropped (the rail stays dormant when none is configured).
+	// YooKassa direct rail: one merchant shop per channel (D42). A shop missing either credential is
+	// dropped, so the rail stays dormant until a channel is fully configured.
+	ykShops := yookassa.Shops{}
+	for channel, prefix := range map[string]string{
+		yookassa.ChannelWeb:     "BACKEND_YOOKASSA_WEB",
+		yookassa.ChannelAndroid: "BACKEND_YOOKASSA_ANDROID",
+	} {
+		if shop := yookassaShop(prefix); shop.Configured() {
+			ykShops[channel] = shop
+		}
+	}
+	vatCode, err := envInt("BACKEND_YOOKASSA_VAT_CODE", yookassa.VatCodeNone)
+	if err != nil {
+		return Config{}, err
+	}
+
+	// Robokassa direct rail: retired but kept wired (see backend/internal/robokassa/README.md). No
+	// deployment sets these, so the set is empty and the direct rail resolves to YooKassa; restoring
+	// the credentials revives it without a code change. The legacy single-shop vars seed the web
+	// channel; the per-channel vars add the rest.
 	shops := robokassa.Shops{}
 	web := robokassaShop("BACKEND_ROBOKASSA_WEB")
 	if web.MerchantLogin == "" {
@@ -190,6 +217,8 @@ func Load() (Config, error) {
 		GuestRetention:    guestRetention,
 		ExportSignKey:     os.Getenv("BACKEND_EXPORT_SIGN_KEY"),
 		RendererURL:       os.Getenv("BACKEND_RENDERER_URL"),
+		YooKassa:          ykShops,
+		YooKassaVatCode:   vatCode,
 		Robokassa:         shops,
 	}
 	if err := c.validate(); err != nil {
@@ -248,6 +277,19 @@ func (c Config) validate() error {
 			return fmt.Errorf("config: robokassa shop %q: password1 and password2 must be set when its merchant login is", channel)
 		}
 	}
+	if !yookassa.ValidVatCode(c.YooKassaVatCode) {
+		return fmt.Errorf("config: BACKEND_YOOKASSA_VAT_CODE %d is not a 54-ФЗ VAT rate code (1..%d)", c.YooKassaVatCode, yookassa.VatCodeMax)
+	}
+	if c.YooKassa.Configured() {
+		// The YooKassa rail sends the customer to a hosted payment page and needs an absolute return
+		// URL to bring them back, which only the public base URL can supply.
+		if c.PublicBaseURL == "" {
+			return fmt.Errorf("config: BACKEND_PUBLIC_BASE_URL must be set when a YooKassa shop is configured")
+		}
+		if u, err := url.Parse(c.PublicBaseURL); err != nil || u.Scheme == "" || u.Host == "" {
+			return fmt.Errorf("config: BACKEND_PUBLIC_BASE_URL %q must be an absolute URL (scheme://host)", c.PublicBaseURL)
+		}
+	}
 	return nil
 }
 
@@ -288,6 +330,18 @@ func envDuration(key string, fallback time.Duration) (time.Duration, error) {
 	return d, nil
 }
 
+// yookassaShop reads a YooKassa shop's credentials from the environment under prefix (e.g.
+// "BACKEND_YOOKASSA_WEB" → _SHOP_ID / _SECRET_KEY / _TEST). _TEST marks a test shop, which lets the
+// intake refuse to credit a live payment against test credentials and vice versa. A shop missing
+// either credential yields a Config the caller drops.
+func yookassaShop(prefix string) yookassa.Config {
+	return yookassa.Config{
+		ShopID:    os.Getenv(prefix + "_SHOP_ID"),
+		SecretKey: os.Getenv(prefix + "_SECRET_KEY"),
+		IsTest:    os.Getenv(prefix+"_TEST") == "1",
+	}
+}
+
 // robokassaShop reads a Robokassa shop's four credentials from the environment under prefix (e.g.
 // "BACKEND_ROBOKASSA_WEB" → _MERCHANT_LOGIN / _PASSWORD1 / _PASSWORD2 / _TEST). A missing
 // MerchantLogin yields a zero Config the caller drops.