Add fake payment API

[jorgeschulz]

Summary

/claim #1

Adds a focused fake payment lifecycle API on top of the starter Winterspec app:

• persists fake payment records in the existing zod/zustand database
• adds POST /payments/send, GET /payments/list, GET /payments/get, POST /payments/complete, and POST /payments/cancel
• supports optional idempotency_key on send so retries return the existing payment with idempotent_replay: true
• supports list filters for status, recipient_email, and repository
• documents the routes in the README

Verification

• npx --yes bun@latest test tests/routes/payments.test.ts
• npx --yes bun@latest test
• npx --yes bun@latest run build
• npx --yes bun@latest x tsc --noEmit
• npx --yes bun@latest x biome check README.md lib/db/schema.ts lib/db/db-client.ts routes/payments tests/routes/payments.test.ts
• git diff --check

Note: tsc --noEmit requires dist/bundle.js to exist, so I ran bun run build before typecheck.

AI-assisted with Codex; I reviewed the diff and ran the checks above before opening this PR.