feat(payment): add refund and reversal functionality to payment gateways

- Implemented `refund` and `reverse` methods in `PaymentGatewayInterface`.
- Added `PaymentRefundResult` class to handle refund operation results.
- Enhanced `MockGateway` and `SepGateway` to support refund and reversal operations.
- Updated `PaymentManager` to include `refundPayment` and `reversePayment` methods for handling refunds and reversals in transactions.
- Modified `ClinicSubscriptionRepository` and `SubscriptionService` to manage subscriptions during refunds.
- Added admin API endpoints for processing refunds and reversals.
- Updated security headers to allow form actions to the sandbox environment.
- Documented the new refund and reversal features in the API documentation.

src/Payment/Gateway/GatewayFactory.php

@@ -39,12 +39,22 @@ class GatewayFactory
         return $this->configRepo->get('payment_test_mode') === '1';
     }
 
+    /** حالت sandbox ملت (banktest.ir) — اتصال واقعی، جدا از test_mode/Mock. موقت. */
+    public function isMellatSandbox(): bool
+    {
+        return $this->configRepo->get('mellat_sandbox') === '1';
+    }
+
     /**
      * درگاهِ قابل‌استفاده برای این نام؛ در حالت تست همیشه Mock، در غیر این‌صورت
      * درگاه واقعی در صورت فعال بودن. null یعنی نامعتبر/غیرفعال.
      */
     public function resolve(string $name): ?PaymentGatewayInterface
     {
+        // sandbox ملت: اتصال واقعی به banktest، نه Mock.
+        if ($name === 'mellat' && $this->isMellatSandbox()) {
+            return $this->gateways['mellat'] ?? null;
+        }
         if ($this->isTestMode()) {
             return $this->mock;
         }
@@ -69,6 +79,9 @@ class GatewayFactory
      */
     public function activeGateways(): array
     {
+        if ($this->isMellatSandbox()) {
+            return [['name' => 'mellat', 'label' => 'بانک ملت (Sandbox)']];
+        }
         if ($this->isTestMode()) {
             return [['name' => 'mellat', 'label' => 'بانک ملت (آزمایشی)']];
         }