feat: implement Safaricom M-PESA Daraja gateway with STK Push sandbox tests

[teesofttech]

Why

M-PESA is a major East African mobile-money rail not covered by the current SDK. Safaricom Daraja 3.0 provides APIs and a sandbox simulation environment.

Official portal: https://developer.safaricom.co.ke/

Scope

• Start with Kenya STK Push and query/status callbacks.
• Model phone/MSISDN validation, shortcode, passkey, OAuth token caching, and callback URLs.
• Treat the asynchronous callback lifecycle explicitly.
• Confirm reversal/refund capabilities and model unsupported operations honestly.
• Add raw callback validation/authentication according to current Daraja guidance.

Acceptance criteria

• Sandbox STK Push request and status/query flow pass with documented test credentials.
• Callback fixtures cover success, cancel, insufficient funds, timeout, duplicate, and malformed payload.
• Tokens are cached safely and refreshed under concurrency.
• Phone numbers and KES amounts are validated correctly.
• Logs redact MSISDN and credentials.
• Capability matrix documents Kenya-only scope of the first release.