Add isolated Razorpay Test Mode rail

[Phloraxx]

Summary

Adds an isolated Razorpay Test Mode only rail for experiments without changing PayGate's existing SMS/DDM payment model.

Backend

• server-side Orders API client with Basic Auth, timeouts, response limits and redirect refusal
• Test Mode key validation (rzp_test_... only)
• separate razorpay_test_orders and razorpay_test_events collections
• operator-authenticated create/get/verify/refresh endpoints
• raw-body webhook HMAC verification for payment.captured and payment.failed
• event-ID and payload-hash deduplication
• mandatory checkout signature verification using the server-stored order ID
• only provider captured state is considered paid
• monotonic transitions prevent stale failure events from downgrading captured/refunded orders
• no raw webhook-payload or customer payment-detail retention

Operator UI

• Razorpay Test page with server-created orders and Standard Checkout
• stable browser idempotency key across failed retries
• provider status refresh and realtime order list
• disabled state until staging Test credentials are configured
• conditional CSP expansion limited to Razorpay Checkout/API origins

Staging

• separate Compose file, localhost port and Docker volume
• Test credential template
• exact Test Mode webhook setup and test matrix in RAZORPAY_TEST.md

Deliberate non-goals

• no Live Mode support
• no changes to normal payments
• no generic provider framework
• no customer-facing production route
• no automatic capture/refund API
• no production deployment in this PR

Verification

• npm audit: 0 vulnerabilities
• frontend typecheck and production build
• all Go tests and vet
• staticcheck and govulncheck
• full go test -race -count=1 ./...
• migration up/down/up cycle
• enabled-mode fresh-container smoke with fake Test credentials
• existing PayGate fresh-volume acceptance with Razorpay disabled

[Phloraxx]

Staging validation completed against a real Razorpay Test Mode account without touching production:

• isolated container and fresh Docker volume
• temporary public Cloudflare tunnel
• Test Key pair accepted by Razorpay Orders API
• real ₹1 test order created and fetched back successfully
• operator-authenticated test UI/config reachable through the tunnel
• Checkout CSP permits only Razorpay test origins when enabled
• invalid webhook signature rejected
• valid signed payment.failed webhook processed
• duplicate event ID deduplicated
• clean checkout order left in created state for interactive testing

PR remains open and unmerged. The temporary tunnel and staging credentials are intentionally separate from production.

[Phloraxx]

Deployment validation completed on 2026-08-02. The merged rail now runs as an isolated private Swarm service (paygate-razorpay-test) with its own Docker volume, no published ports, Google Messages disabled and Test Mode credentials only. The public IEEE portal reaches it through a separate server-to-server API key. Verified on https://pay.ieeesahrdaya.com: real ₹1 Test order creation, raw signed webhook transport, duplicate event deduplication, order status transition, invalid/missing signature rejection, and absence of API/webhook/key secrets from the public bundle. Production PayGate (main-payment-17aqux) was not changed.