Migrate reconcile + tipping onto PaymentProvider trait; add worker tests

Two compat-path holdovers migrated:

- src/reconcile.rs: was state.btcpay_client().get_invoice() with
  manual JSON parsing of BTCPay-specific status strings ("Settled",
  "Complete", "Expired", "Invalid"). Now state.payment_provider()
  .get_invoice_status() returning the typed ProviderInvoiceStatus
  enum. The string normalization moves into BtcpayProvider's impl
  where it belongs.

- src/tipping.rs: was state.btcpay_client().pay_lightning_invoice()
  returning raw JSON, then manual paymentHash extraction. Now
  provider.pay_lightning_invoice() returning a typed PaymentReceipt
  { payment_hash, raw }. The audit message now records the active
  provider's kind() rather than hardcoding "BTCPay LN node".

Combined with v0.1.0:43's purchase migration, the daemon's
non-test code now contains zero calls to state.btcpay_client() or
.btcpay_webhook_secret(). Those compat accessors stay on AppState
for v0.2 (no need to break things gratuitously) but they're dead
code in the production path. Zaprite's drop-in only needs to
implement the trait.

Worker integration tests (tests/worker.rs):

- worker_marks_failure_and_schedules_retry_on_500: spins up a tiny
  axum receiver that 500s, calls webhooks::tick(), verifies attempt
  count and next-attempt scheduling.
- worker_dead_letters_after_max_attempts: seeds a row at attempt
  count 9, ticks once, verifies attempt_count → 10 and
  next_attempt_at → NULL. Confirms the row also satisfies the admin
  DLQ predicate (the contract :43's webhook_deliveries.rs depends
  on).
- worker_marks_success_on_2xx: pins the happy path.

webhooks::tick is now `pub` so integration tests can drive it
synchronously.

Test count: 26 (9 unit + 4 migration + 10 API + 3 worker).

licensing-service/src/reconcile.rs

@@ -41,8 +41,12 @@ pub fn spawn(state: AppState) {
 }
 
 async fn tick(state: &AppState) -> anyhow::Result<()> {
-    let btcpay = match state.btcpay_client().await {
-        Ok(c) => c,
+    // Provider-agnostic. Each provider's impl handles the
+    // provider-specific status-string normalization (BTCPay's
+    // "Settled"/"Complete"/"Expired"/"Invalid" → ProviderInvoiceStatus
+    // enum); this loop just operates on the typed result.
+    let provider = match state.payment_provider().await {
+        Ok(p) => p,
         Err(_) => return Ok(()), // not configured yet — skip silently
     };
 
@@ -56,21 +60,17 @@ async fn tick(state: &AppState) -> anyhow::Result<()> {
     tracing::debug!(count = pending.len(), "reconciling pending invoices");
 
     for inv in pending {
-        match btcpay.get_invoice(&inv.btcpay_invoice_id).await {
-            Ok(raw) => {
-                let status_str = raw
-                    .get("status")
-                    .and_then(|v| v.as_str())
-                    .unwrap_or("")
-                    .to_string();
-                let normalized = match status_str.as_str() {
-                    "Settled" | "Complete" => Some("settled"),
-                    "Expired" => Some("expired"),
-                    "Invalid" => Some("invalid"),
-                    // still in flight
-                    _ => None,
+        match provider.get_invoice_status(&inv.btcpay_invoice_id).await {
+            Ok(status) => {
+                use crate::payment::ProviderInvoiceStatus::*;
+                let new_status = match status {
+                    Settled => "settled",
+                    Expired => "expired",
+                    Invalid => "invalid",
+                    // Pending stays pending; Refunded is a v0.3 surface
+                    // that the webhook handler also short-circuits on.
+                    Pending | Refunded => continue,
                 };
-                let Some(new_status) = normalized else { continue };
 
                 if new_status == inv.status.as_str() {
                     continue; // no-op