Fix the PayPal payment page findings: cancelled wallet attempts and 3D Secure card captures

[GSadee]

Q	A
Branch?	phase-2-payment-requests
Bug fix?	yes
New feature?	no
Related tickets

Fixes for the QA observations on the payment page after Payment Requests refactor. When a buyer closes the PayPal window, the shop now shows a message and makes no needless PayPal calls. The shop also no longer skips the capture of a card paid with 3D Secure. Checking that last case turned up a regression in the first commit, fixed here in the third.

What changes

• The PayPal order is read before it is captured. PaymentCaptureProcessor used to patch the order (amount, shipping address) and try the capture without checking the order first. Each attempt the buyer left unapproved cost two PATCH calls, a 422 ORDER_NOT_APPROVED capture and a paypal.ERROR log entry before the follow-up read cancelled it. The processor now reads the order first and patches and captures it only when it can be captured. Any other order goes to the handler as read. The 422 issues it already accepted are still accepted, in case the order changes between the read and the capture. A successful capture now costs one extra read.
• A card order PayPal leaves CREATED after 3D Secure is captured. After a successful 3D Secure authentication (Y/Y/POSSIBLE), PayPal leaves a card-fields order in CREATED, not APPROVED. A CREATED order now blocks the capture only for payment sources the buyer approves in the PayPal window (PayPal, Pay Later, Venmo), where that status means the attempt was abandoned. Card and wallet orders left CREATED are captured.
• Closing the PayPal window tells the buyer the payment was cancelled. Before, onCancel only unlocked the button, so the buyer stayed on an unchanged page. The create-order endpoint now also returns a cancel_url: the attempt's pay URL with payer_cancelled, as the bank redirect already uses. On cancel, the wallet buttons go to that URL. The capture reads the unapproved order, cancels the attempt and sends the buyer back to a fresh payment page with "PayPal payment has been cancelled".