bug: persist refunds and prevent cumulative partial refunds from exceeding the payment

[teesofttech]

Why

PaymentService.RefundPaymentAsync only compares the current request with the original amount and has a TODO instead of saving RefundTransaction. Multiple partial refunds can therefore exceed the original payment, and refund history is unavailable.

Scope

• Implement and register IRefundRepository.
• Persist pending, successful, and failed refund attempts with provider references.
• Calculate refundable balance from successful/pending refunds.
• Enforce the limit transactionally to prevent concurrent over-refunds.
• Model asynchronous provider refund status updates.

Acceptance criteria

• Cumulative successful/pending refunds cannot exceed the captured amount.
• Every provider refund attempt is auditable without storing sensitive payload fields.
• Full refunds update payment state only after provider confirmation.
• Concurrent refund tests prove the invariant.
• A migration and rollback guidance are included.