feat(payments): add payment intent and Stripe Checkout endpoints

[RUKAYAT-CODER]

Closes #371

Summary

The payments module already covered customers, subscriptions, invoices and signature-verified webhooks with subscription sync — but it had no way to create a payment intent or initiate a checkout flow (acceptance criterion #1). This PR adds both.

Changes

• POST /payments/payment-intents — creates a Stripe payment intent for the authenticated user's customer and returns the clientSecret for the frontend to confirm. Accepts an optional idempotencyKey, forwarded to Stripe as a request idempotency key, so a retried payment submission reuses the original intent instead of double-charging.
• POST /payments/checkout — creates a Stripe Checkout session in subscription (default) or payment mode and returns the hosted-checkout url.
• StripeService: createPaymentIntent(params, options?) and createCheckoutSession(params) wrappers over the Stripe SDK.
• PaymentsService: createPaymentIntent() / createCheckoutSession() that resolve (or create) the caller's Stripe customer, then delegate to StripeService.
• Two request DTOs (CreatePaymentIntentDto, CreateCheckoutSessionDto) with class-validator rules matching the module's conventions.
• src/payments/README.md documents the new endpoints.

Acceptance criteria mapping

• Endpoint to create payment intents and initiate checkout flows — added here.
• Webhook endpoint with signature verification — already present (payments-webhook.controller.ts / stripe.service.constructEvent).
• Subscription model synced from webhooks — already present (subscription.entity.ts, upsertSubscriptionFromStripe).
• Idempotency for webhooks and payment retries — webhook idempotency via webhook-event.entity.ts; payment-retry idempotency via the new idempotencyKey.
• Docs — src/payments/README.md updated.

Verified locally against the repo's CI checks: npx tsc --noEmit and npm run build both pass.