Support authorize-then-capture in the settle step, and purge an instance's pinned payments on delete

Follow-up to the kessai payment lifecycle standardization (kessai issue 3609923): wires orchestra_payment to the new authorize / capture model so a reserve-first checkout is captured off the request path, and cleans up an instance's payments when it is deleted.

• PaymentWorkflowBridge wakes the parked payment step on both the authorized event (a reserve-first checkout, so the run advances before the capture) and the captured event (a direct sale), guarded to a pinned KIND_PAYMENT so a deposit authorization never wakes it.
• SettleTask captures the instance's authorized checkout through the engine's retry (a transient gateway race is retried, then raises an incident once attempts are spent; a permanent refusal records a declined outcome), passes through an already-captured direct sale, and adds a cancel-when-nothing-is-owed option so a zero-amount authorization can be kept as a standing pre-authorization.
• PaymentInteraction treats a pinned authorized or captured checkout as done for the step.
• New: deleting a process instance deletes the checkout payments pinned to its tokens (the local rows are operational mirrors; the provider back office keeps the authoritative record). Only token-pinned checkout payments are removed; a deposit is scoped to its order.

Adopts the renamed kessai states and methods throughout, and updates the docs and the French translation. Kernel tests are green.