Fix PCI Pay over Voice sample flow

[anusha-telnyx]

Summary

• align the PCI payment sample with the current Pay over Voice docs by trying /v2/calls/{call_control_id}/pay first
• remove custom IVR prompts so Telnyx default step-by-step Pay prompts are used
• guard the assistant completion marker until Telnyx sends a real payment completion event
• add missing phone_from_payload helper and sanitize call IDs in dashboard command events
• update README/API/GUIDE wording around Pay events and completion proof

Validation

• python3 -m py_compile ai-pci-protected-payment-collection-python/app.py ai-pci-protected-payment-collection-python/provision_assistant.py
• local Flask smoke test for /health and /webhooks/payment-processor
• git diff --check

[semgrep-code-team-telnyx]

Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.

✨ Fixed in commit 585a07a ✨