Distinguish a payer-cancelled checkout from a failed payment: record it Cancelled, not Failed

When a payer cancels the Worldline hosted checkout, kessai records the payment as Failed, indistinguishable from a real problem (a card decline, a technical error, an amount mismatch). An operator scanning the payments cannot tell a routine abandonment from a payment that actually errored. On top of that, the finalizer's not-accepted branch fails the payment silently (no log), so there is no trace of why it failed without querying the provider.

Fix

• Add PaymentManager::cancelPending(): the counterpart to fail() for a pending payment the payer cancelled, a locked PENDING to CANCELLED transition that announces CANCELLED. Nothing was taken, so no gateway call. Reuses the existing CANCELLED state.
• WorldlineGateway::paymentCancelledByConsumer(): a cancelled checkout comes back as a created payment in the CANCELLED status; a decline is REJECTED.
• The finalizer records a consumer cancellation as cancelled and everything else (declined, ambiguous, no created payment) as failed, and logs the outcome either way, so it is never silent.

Tests

PaymentManagerTest covers cancelPending (records CANCELLED, idempotent, never overrides a captured payment). WorldlineFinalizerTest covers a cancelled checkout recorded CANCELLED and a declined one still failed.

Kessai-only: routing a cancellation differently in a workflow consumer is a separate follow-up.