feat(payments): settle the direct rail through YooKassa

Replace Robokassa with YooKassa as the RUB direct-rail provider. The wallet
model is untouched: one `direct` segment, the same spend wall, the same
per-channel merchant shops (D42) and `shop` on the order (D44).

The two providers are not shaped alike, and that drives the change:

- Opening a purchase is now an outbound API call (`POST /v3/payments`,
  single-stage capture, redirect confirmation). The order id is both the
  `Idempotence-Key` and `metadata.order_id`, so a retried create cannot mint a
  second payment and a notification always resolves to its order.
- YooKassa does NOT sign notifications, so the body is never evidence: it only
  names a payment, which is re-read with `GET /v3/payments/{id}`, and only that
  answer is acted on. Two guards ride on it — the payment's metadata must name
  the order, and its `test` flag must match the shop's, so a test-shop payment
  can never credit real chips. The sender address is checked against YooKassa's
  published ranges first, which stops a forger turning each fabricated
  notification into an outbound call of ours.
- A notification lost for good would leave the money taken and the chips unowed,
  silently. The existing pending-order reaper now asks the provider about each
  order that reached its expiry age carrying a payment id, and credits the ones
  really paid — one request per order over its whole life, not polling.
- `payment.canceled` records a `failed` event, so a declined payment is finally
  surfaced to the customer as PAYMENTS.md §9 already specified.
- The admin refund moves the money through `POST /v3/refunds` before recording
  anything; a failed call records nothing, so the ledger cannot claim a refund
  that did not happen, and the recorded id is the provider's own.
- YooKassa has no cabinet-side generic receipt: «Чеки от ЮKassa» registers one
  only if the request carries it, so every payment and refund now sends an
  itemized `receipt` to the D36 confirmed email. The VAT rate code is a deploy
  variable; the settlement subject and method are constants.

Robokassa is retired, not deleted: the direct rail falls back to it when no
YooKassa shop is configured and no deployment sets its credentials, so reviving
it is a credentials change rather than a code change. Its variables are removed
from compose, .env.example, write-prod-env.sh and the three workflows, and
recorded in backend/internal/robokassa/README.md together with the cabinet
configuration and the revival steps. Ledger rows keep `provider = 'robokassa'`;
that literal is load-bearing for the idempotency index.

No migration and no wire change: `orders.provider_payment_id` already existed,
and the client is rail-agnostic.

Decisions D47-D51 (revising D41) and stage E12 are baked into the docs.

backend/internal/server/handlers_admin_refund.go

@@ -1,6 +1,7 @@
 package server
 
 import (
+	"context"
 	"encoding/csv"
 	"fmt"
 	"strconv"
@@ -9,11 +10,17 @@ import (
 
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
+	"go.uber.org/zap"
+
+	"scrabble/backend/internal/payments"
 )
 
-// consoleRefund refunds a paid order in full at the operator's request. The operator performs the
-// actual money refund on the rail (Robokassa cabinet / VK support / Telegram refundStarPayment);
-// this records it — a refund ledger row and a floor-0 chip revoke (never negative, D27). Idempotent.
+// consoleRefund refunds a paid order in full at the operator's request: it records the reversal — a
+// refund ledger row and a floor-0 chip revoke (never negative, D27) — and, on the direct rail, moves
+// the money back through the provider's refund API first, so one click does the whole job and the
+// ledger cannot claim a refund the provider never made. The rails with no refund API of ours (VK
+// support, Telegram refundStarPayment, the Robokassa cabinet) still need the operator to move the
+// money by hand; this records that. Idempotent either way.
 func (s *Server) consoleRefund(c *gin.Context) {
 	id, ok := s.consoleUUID(c, "/_gm/users")
 	if !ok {
@@ -29,7 +36,13 @@ func (s *Server) consoleRefund(c *gin.Context) {
 		s.renderConsoleMessage(c, "Refund failed", "no order to refund", back)
 		return
 	}
-	out, err := s.payments.RefundOrderFull(c.Request.Context(), orderID)
+	ctx := c.Request.Context()
+	ref, err := s.payments.OrderProviderRef(ctx, orderID)
+	if err != nil {
+		s.renderConsoleMessage(c, "Refund failed", err.Error(), back)
+		return
+	}
+	out, err := s.refundOrder(ctx, ref)
 	if err != nil {
 		s.renderConsoleMessage(c, "Refund failed", err.Error(), back)
 		return
@@ -46,6 +59,25 @@ func (s *Server) consoleRefund(c *gin.Context) {
 	s.renderConsoleMessage(c, "Refunded", msg, back)
 }
 
+// refundOrder reverses a paid order, moving the money back through the rail's own refund API when
+// there is one. The provider call comes first and a failure aborts with nothing recorded: the ledger
+// must never claim a refund that did not happen. The reversal is then recorded under the provider's
+// own refund id, which keeps the ledger reconcilable against the provider's records.
+//
+// A rail with no refund API of ours records under the operator's key instead, and the operator moves
+// the money by hand (VK support, Telegram refundStarPayment, the Robokassa cabinet).
+func (s *Server) refundOrder(ctx context.Context, ref payments.OrderRef) (payments.RefundOutcome, error) {
+	if ref.Provider != providerYooKassa {
+		return s.payments.RefundOrderFull(ctx, ref.OrderID)
+	}
+	refundID, err := s.refundYooKassa(ctx, ref)
+	if err != nil {
+		s.log.Error("yookassa refund failed", zap.String("order", ref.OrderID.String()), zap.Error(err))
+		return payments.RefundOutcome{}, fmt.Errorf("the provider did not refund the payment, nothing was recorded: %w", err)
+	}
+	return s.payments.RefundOrderFullAs(ctx, ref.OrderID, providerYooKassa, refundID)
+}
+
 // consoleLedgerExport streams the entire append-only ledger as a CSV attachment for tax reporting
 // and rail reconciliation. The snapshot column carries the raw purchase/refund JSON.
 func (s *Server) consoleLedgerExport(c *gin.Context) {