Expire lapsed payments (kessai.expired and a cron reaper)

A payer who leaves the hosted checkout and never returns leaves the payment pending forever, and any hold a consumer placed for it (a locked booking order) with it. Give payments a deadline and reap them.

A new terminal state STATE_EXPIRED and event PaymentEvents::EXPIRED, distinct from a decline (FAILED) and a deliberate withdrawal (CANCELLED): nobody acted, the window simply closed.

create() gains a ttl in seconds; it stamps an expires timestamp, defaulting to the configured default_payment_ttl. A non-positive ttl opts out of expiry.

expire() and expireDue() on the manager are row-locked like the other transitions, so a real outcome arriving at the deadline still wins; a cron hook runs the sweep, and a state and expires index covers it.

Covered by a kernel test: the deadline stamping, the sweep, and the cron hook.