Phase 5.x payment revamp + Xendit Stage-8 prep

- Backend wraps idn-finlogos npm at /assets/payment-icons/<slug>.svg with
  1y immutable cache. Mobile drops bundled SVGs (only placeholder remains)
  and fetches via flutter_cache_manager. payment_methods.icon is now a
  CSV of slugs; catalog emits icon_urls[]. CARDS tile renders Visa + MC +
  JCB side by side.
- Per-method min/max amount bounds (BIGINT, nullable). Picker greys out
  out-of-range tiles with subtitle; backend gates with INVALID_PAYMENT_AMOUNT
  (422). Defense in depth against stale-catalog clients.
- Xendit channel codes corrected from authoritative docs
  (BCA_VA -> BCA_VIRTUAL_ACCOUNT, CREDIT_CARD -> CARDS, ovo -> ovo-new,
  shopeepay -> shopee-pay, ...). 18 methods x 5 groups seeded with
  Xendit-published per-channel min/max.
- Re-runnable seed (ON CONFLICT DO NOTHING on payment_code + new unique
  index on group name). Operator CC edits never clobbered across re-runs.
  One-shot reset + inspect scripts under backend/.dev/.
- Customer redirect HTML pages at /payment/return/{success,failure},
  brand-styled with "Buka HaloBestie" CTA firing halobestie:// deeplink.
  URL scheme registered on Android (intent-filter w/ BROWSABLE on
  MainActivity) and iOS (CFBundleURLTypes). Waiting-payment poller still
  owns confirmation; deeplink just brings the activity to foreground.
- Control center payment-catalog page: min/max inputs + columns. Other
  CC pages restyled with new theme tokens (separate work, bundled here).

169/169 backend tests pass. See requirement/phase5-payment-revamp-2026-05-27.md
for the full revamp doc. Stage 8 (E2E) still pending: webhook URL routing
decision + two client_app follow-ups (legacy /chat/request removal,
extension Custom Tab).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

client_app/pubspec.yaml

@@ -42,12 +42,13 @@ dependencies:
   # (mock mode encodes payment_session_id; real QR will come from Xendit later).
   qr_flutter: ^4.1.0
 
-  # Payment method icons (Phase 5.x catalog) — bundled SVGs under
-  # assets/payment_icons/, copied from github.com/hafidznoor/idn-finlogos.
-  # Xendit's per-channel media-asset pages were planned but found
-  # decommissioned during implementation. See
-  # `requirement/phase5-payment-catalog-plan.md` §7 for the sourcing decision.
+  # Payment method icons (Phase 5.x catalog). Source-of-truth is the backend
+  # `/assets/payment-icons/<slug>.svg` endpoint, which wraps the `idn-finlogos`
+  # npm package. Mobile only bundles `placeholder.svg` as the first-launch /
+  # offline fallback; everything else is fetched on demand and persisted via
+  # `flutter_cache_manager` for far-future reuse.
   flutter_svg: ^2.0.10+1
+  flutter_cache_manager: ^3.3.1
 
   # OS notification permission — used by the post-payment notif gate
   # (Phase 4 Stage 4) and the home banner.