Settle or fail a parked payment step by hand from the instance trace

Problem/Motivation

A payment step waits for its gateway to report the outcome (a browser return, a server-to-server webhook, an operator). When a webhook never arrives, the payment was taken offline, or a maintainer is driving a workflow through in testing, there is no way from the admin instance trace to move the parked step on.

Proposed resolution

Through the hook_orchestra_ui_token_operations_alter hook, orchestra_payment adds two operations to a parked payment token that still has an in-flight payment: "Mark payment paid" and "Mark payment failed" (gated on administer orchestra). Marking paid settles the payment at the manager, which is the same settlement a verified gateway callback ultimately performs, so the settlement bridge resumes the pinned step and the run advances; it does not go through a gateway webhook or finalizer, so it is gateway-agnostic and reproduces the outcome, not the callback. Marking failed leaves the step parked for a retry.

The query that finds the payment pinned to a token is extracted into a shared PinnedPayment service, used by the operations, their controller and the payment interaction (which previously carried its own copy). Covered by a kernel test; the payment documentation and French translations are updated.

Remaining tasks

• Review.