Add an orchestra_payment bridge: take a payment as a workflow step, backed by Kessai

Add an orchestra_payment submodule that lets a workflow take a payment as a step, as a thin bridge over the Kessai payment engine (drupal.org/project/kessai). Kessai owns the money (the payment entity, the gateway plugins, the settle/fail state machine); this bridge connects a parked workflow step to it.

What it adds

• A payment interaction (id "payment") hosted on a wait node: it resolves what to charge, creates a Kessai payment pinned to the parked token, and hands the visitor to the gateway. The landing page offers Go to payment, Change details (the back outcome) and Cancel (the cancelled outcome).
• A PayableResolver plugin type (interface, attribute, base, manager) so the step stays domain-neutral. A resolver returns a Payable (amount, currency, gateway, optional subject) or nothing when there is nothing due. A bundled "variable" resolver reads the amount, currency and gateway process variables, so a workflow can charge out of the box; a domain module ships its own (a booking module prices from the order).
• A settlement bridge subscribing to the Kessai payment events: on settlement it resumes exactly the pinned token with the "paid" result (so a late or duplicate provider signal cannot resume whatever step is parked later); on failure it leaves the step parked for a retry. The result is written to the node result variable so outgoing flows route on paid, cancelled, back or timeout.
• Two base fields on the Kessai payment entity (orchestra_token and delete_token_on_end), added by this bridge, and a run-end cleanup that deletes flagged stored cards when the instance reaches any terminal state.

Example

An orchestra_payment_example submodule ships a ready-to-run "Example: take a payment" workflow (a fixed demo amount through the Kessai simulator gateway) and a minimal example resolver, so the flow can be tried with nothing to configure.

Tests

A kernel test drives the example workflow: it parks on the payment step, simulates a settlement, and asserts the pinned token resumes with "paid" and the run advances; it also covers a failed payment leaving the step parked, an unpinned payment left for another subscriber, and both resolvers. All green. phpcs, cspell and the French translations validate.

Notes

The bridge depends on Kessai, added to the module composer require-dev so static analysis resolves it. Documentation is added under docs/payment.md.