feat: hosted checkout URL, redirect_url, and OpenAPI docs for payment links

[Emmyt24]

Summary

A developer had no way to actually integrate payment links into their own checkout: create-link responses only returned a bare slug (the /pay/{slug} URL convention existed only as client-side JS in the dashboard frontend), there was no way to redirect a payer back to the merchant's site after paying, and docs/openapi.yaml had zero entries for any payment-link route.

• Migration 0017: nullable redirect_url column on payment_links.
• PaymentLinkView / PublicPaymentLinkView gain url (the full hosted checkout URL, built server-side from a new PUBLIC_APP_URL config var, defaulted to http://localhost:3000 the same way HORIZON_URL defaults) and redirect_url (bare passthrough, same treatment as image_url — it's merchant-set via their own API key and only ever used for a browser redirect, never fetched server-side, so no SSRF surface).
• docs/openapi.yaml: added all 8 payment-link routes (owner-authenticated create/list/get/activate/payments, and the public /v1/pay/:slug/* checkout flow) with matching response schemas, mirroring the actual Rust response shapes field-for-field.
• New test: payment_link_response_includes_checkout_url_and_redirect_url — confirms url is a real hosted checkout link and redirect_url round-trips through create, owner-authenticated get, and the public route.

No SDK — this is a server-to-server integration (create a link, get a URL, redirect, get webhooked via the existing payment_link.paid event), not client-side signing. Reference: Blockradar's checkout docs use the same shape and ship no SDK either.

Companion frontend PR wires the returned url/redirect_url into the dashboard and the hosted /pay/[slug] checkout page, plus a new /docs/checkout page.

Test plan

• cargo test --workspace --locked — 37/37 green
• cargo clippy --workspace --all-targets --locked -- -D warnings — clean
• cargo fmt --all -- --check — clean
• Live smoke test against a running server: created a link with redirect_url, confirmed the response's url field is a working link and redirect_url round-trips through create/get/public routes