Phase 5 Xendit: Stages 1-7 (XENDIT_ENABLED=false; Stage 8 pending creds)

Backend
- payment_sessions → payment_requests rename across DB schema + 29 files
- payment.service.js becomes product-agnostic owner: EventEmitter +
  Xendit wrapper + requestPayment / confirmPayment public API; legacy
  aliases retained for existing chat callers
- Webhook handler at POST /api/shared/payment/webhooks/xendit, with
  constant-time token verification (8 vitest cases)
- Server-driven pairing: payment.service emits
  payment_request.confirmed → pairing subscriber starts the blast.
  Legacy POST /chat/request still works during the cutover.
- Reconciliation sweeper extended (re-emits events for confirmed rows
  with no chat session)
- SIGTERM drain + startup reconciliation pass in server.js

Customer app
- waiting_payment_screen opens xendit_invoice_url via
  LaunchMode.inAppBrowserView
- searching / no-bestie / targeted-waiting / pairing-notifier updated
  to consume the new payment_request_id contract
- pending_payments_provider + bestie-unavailable dialog migrated

Dev / testing
- XENDIT_ENABLED=false is the safe default; .env.example documents the
  four new vars
- backend/.dev/xendit-fake-webhook.sh exercises the handler without
  ngrok
- 90/92 backend tests pass (two pre-existing session-timer flakes,
  unrelated); client_app analyzer clean
- requirement/phase5-xendit-plan.md is the canonical reference

Stage 8 (live E2E) blocked on Xendit test-mode keys. The dashboard's
single-webhook-URL constraint will be worked around via a self-poll
script next session.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

backend/test/helpers/db.js

@@ -9,7 +9,7 @@ export const db = () => getDb()
 /**
  * Truncate Phase 3.7-relevant tables between tests.
  *
- * Order matters: pairing_failures FK → payment_sessions; chat_request_notifications
+ * Order matters: pairing_failures FK → payment_requests; chat_request_notifications
  * FK → chat_sessions; customer_transactions FK → chat_sessions; etc. Use CASCADE so
  * we don't have to maintain the topological order when tables get added.
  *
@@ -19,7 +19,7 @@ export const db = () => getDb()
  */
 const TRUNCATE_TABLES = [
   'pairing_failures',
-  'payment_sessions',
+  'payment_requests',
   'chat_request_notifications',
   'session_extensions',
   'session_closures',
@@ -70,7 +70,7 @@ export const resetAppConfig = async () => {
     ['extension_timeout_seconds', { value: 60 }],
     ['early_end_mitra_enabled', { value: false }],
     ['early_end_customer_enabled', { value: false }],
-    ['payment_session_timeout_minutes', { value: 20 }],
+    ['payment_request_timeout_minutes', { value: 20 }],
     ['returning_chat_confirmation_timeout_seconds', { value: 20 }],
     ['extension_default_action_on_timeout', { value: 'auto_approve' }],
     ['pairing_blast_timeout_seconds', { value: 60 }],