Add merchant metadata to payment intents

[bumblebee-2020]

Summary

Add merchant metadata to payment intents

What was solved

#890 — Payment intents can't carry merchant metadata (order ID, customer reference, description)

Add optional merchant metadata to payment intents: accept a validated flat string→string metadata object on POST /v1/payments, persist it in a new additive metadata TEXT (JSON) column on payments, return it from the authenticated GET /v1/payments/{id} and list endpoints, and include it in every webhook payload (covered by HMAC). The public unauthenticated projection must never expose it. Limit violations return 400 invalid_metadata naming the offending key. Document the no-secrets/no-card-data rule in openapi.yaml and README.

Addressed:

• Changed: README.md
• Add optional metadata field to CreatePaymentRequest (flat JSON object, string keys to string values).
• Validate limits: ≤20 keys, key ≤40 chars, value ≤500 chars, total ≤4 KiB; return 400 invalid_metadata naming the offending key on violation.
• Add additive migration creating metadata TEXT (JSON) column on payments.

Changes

• README.md (modify)

Approach

1. Add optional metadata to CreatePaymentRequest in src/api/payments.rs with validation (≤20 keys, key ≤40, value ≤500, serialized total ≤4 KiB) returning 400 invalid_metadata naming the offending key.
2. Add an additive migration creating a nullable metadata TEXT (JSON) column on payments, and persist/parse metadata on create.
3. Return metadata from the authenticated GET /v1/payments/{id} and list endpoints, while keeping the public unauthenticated projection free of metadata.
4. Include metadata in every webhook payload in src/webhook.rs so it is covered by the HMAC signature.
5. Document the no-secrets/no-card-data rule and the metadata field in openapi.yaml and README.md.

Issues

Closes #890