feat: implement PayPal Orders v2 gateway with sandbox and negative testing

[teesofttech]

Why

PayPal adds a widely recognized global wallet option. The current Orders v2 API supports server-side create/capture and refunds, and the sandbox supports both successful flows and simulated negative responses.

Official docs:

• https://developer.paypal.com/docs/checkout
• https://developer.paypal.com/tools/sandbox/
• https://developer.paypal.com/tools/sandbox/negative-testing/request-headers/

Scope

• Use OAuth client credentials and Orders v2, not legacy NVP/SOAP.
• Map PayBridge create to order approval URL, verification to order/capture status, and refunds to captured-payment refunds.
• Decide whether capture happens on return/webhook or requires a separate capability.
• Verify PayPal webhook signatures.

Acceptance criteria

• Sandbox buyer/seller happy path passes.
• Negative tests cover duplicate ID, decline, auth, rate limit, and capture failure.
• Token caching is concurrency-safe.
• Order ID and capture ID are persisted distinctly.
• Refunds target the capture identifier.
• No browser-delivered client secret or deprecated API is used.