Pre-1.0.0-alpha11 audit fixes: payment/token indexes, inbox tenant cache context, lazy flow variables, N+1 batching, and hardening

Fixes from the pre-alpha11 full audit (baseline clean: phpcs, phpstan false-positives only, whole kernel+unit suite green). One MR.

Performance

• Index the bridge's orchestra_token field on kessai_payment: the settlement and payment-step lookups scanned the shared payments table. orchestra_payment swaps in a storage schema that keeps kessai's subject index and adds (orchestra_token, kind, state).
• Add a (tenant, status) index to orchestra_token for the account-wide pending-actions scan.
• Add a (tenant, id) index to orchestra_instance for the remote API's newest-first instance list.
• Resolve flow-condition variables lazily: the engine no longer runs the lineage and variable queries when a node's outgoing flows are all unconditional.
• Batch the instance trace's "Open" links (one work-item query per page, not per row) via an optional BatchActUrlInterface; memoize settings-only assignment audiences in the pending-actions scan; warm the Views node/workflow label loads in preRender.

Cache correctness

• Add the orchestra_tenant cache context to the inbox render: without it a task list cached on one tenant's domain could be served to the same account on another tenant's domain.
• Set cache: none on the shipped trace and tokens Views, whose token state is mutated by raw SQL that never invalidates cache tags.

Hardening and config

• orchestra_client: accept an IPv6 loopback and an uppercase HTTPS scheme, and ignore a non-scalar allowlist entry.
• Add Choice constraints to the notify delivery (to/cc/bcc) and webform interaction mode (collect/view/edit) config schema.
• Mark the public interaction signal route no_cache, matching its step and comment siblings.

Docs and translations

• Document the orchestra_client.allow_http_hosts settings.php key, the trace "Open" link, and the decision/decision.result equivalence; note the core "Open" key in the token-operations hook example. Update the French translations for the touched strings.

Tests

New/updated kernel tests: lazy variable resolution (a query-log discriminator), the inbox tenant context, the pending-actions batch, and the HttpsPolicy IPv6/uppercase cases. Full kernel+unit suite green.

Deferred to their own follow-ups (unchanged): the unbounded pending-actions scan/pager and teardown walks (PERF-3/PERF-4), the workflow_version index, and the 12 missing submodule READMEs (a pre-existing completeness gap).