Complete Payment module: initiate/webhook/confirm/refund actions, Filament resources (T5.8-T5.13)

- InitiatePaymentAction + POST /api/v1/payments/{booking}/initiate
- Generic KBZ webhook (POST /api/v1/webhooks/{method}/{encryptBookingId?}),
  signature verification per KBZ's real callback spec, PaymentGatewayInterface::handleWebhook()
- ConfirmPaymentAction: idempotent confirmation, PaymentCompleted/PaymentFailed events,
  MarkBookingPaid listener
- RefundBookingAction + POST /api/v1/bookings/{booking}/refund: partial refunds validated
  against remaining balance, RefundProcessed event, MarkBookingRefunded listener
- CancelBookingAction now refunds confirmed bookings instead of rejecting; BookingPolicy::cancel
  requires process_refunds for confirmed bookings
- PaymentPlugin + PaymentResource/RefundResource Filament admin UI (read-only payments,
  refund list + Process action)
- Booking detail page now shows related payments
- Fix CACHE_STORE mismatch (database -> redis) so tagged route caching works
- CLAUDE.md: never run migrate:fresh/migrate:refresh/db:wipe on dev without being asked

app-modules/booking/src/Actions/CancelBookingAction.php

@@ -5,17 +5,37 @@ namespace Modules\Booking\Actions;
 use Modules\Booking\Enums\BookingStatus;
 use Modules\Booking\Exceptions\BookingCannotBeCancelledException;
 use Modules\Booking\Models\Booking;
+use Modules\Payment\Actions\RefundBookingAction;
 
 /**
- * Unpaid path only — a pending_payment booking has no money moved yet, so
- * it can be cancelled directly. A confirmed (paid) booking must go through
- * a refund first; this action explicitly guards against bypassing that
- * (domain.md §5). Wired into that refund path in T5.12.
+ * A pending_payment booking has no money moved yet, so it cancels directly.
+ * A confirmed (paid) booking is cancelled by refunding it in full first —
+ * delegates to RefundBookingAction (Payment module); the booking only
+ * actually flips to cancelled once that refund succeeds, via
+ * RefundProcessed/MarkBookingRefunded, not here (domain.md §5). Any other
+ * status (already cancelled/expired) is rejected outright.
  */
 class CancelBookingAction
 {
-    public function handle(Booking $booking): Booking
+    private const CANCELLATION_REFUND_REASON = 'Booking cancellation';
+
+    public function __construct(
+        private RefundBookingAction $refundBookingAction,
+    ) {}
+
+    public function handle(Booking $booking, ?int $requestedBy = null): Booking
     {
+        if ($booking->status === BookingStatus::Confirmed) {
+            $this->refundBookingAction->handle(
+                $booking,
+                (string) $booking->price,
+                self::CANCELLATION_REFUND_REASON,
+                $requestedBy,
+            );
+
+            return $booking->refresh();
+        }
+
         if ($booking->status !== BookingStatus::PendingPayment) {
             throw BookingCannotBeCancelledException::notPendingPayment($booking);
         }