feat: implement Pesapal API 3.0 gateway and IPN sandbox coverage

[teesofttech]

Why

Pesapal adds East African card and mobile-money coverage and provides a REST/JSON API 3.0 with documented sandbox and live endpoints. API 2.0 is deprecated, so the integration must explicitly target API 3.0.

Official docs:

• https://developer.pesapal.com/how-to-integrate/e-commerce/api-30-json/api-reference
• https://developer.pesapal.com/

Scope

• Implement OAuth token acquisition, IPN registration, order submission, status lookup, and supported refund flow.
• Persist provider tracking ID and merchant reference separately.
• Model sandbox/live base URLs.
• Verify IPN authenticity and replay behavior.

Acceptance criteria

• No API 2.0 endpoint or OAuth 1.0 sample is used.
• Unit fixtures cover token, submit, redirect, IPN, status, error, and malformed payloads.
• Sandbox create and status flow pass in CI.
• Duplicate IPNs are idempotent.
• Supported countries/currencies/payment methods are documented from current provider docs.