fix(security): unique payment reference_id, reject replayed callbacks (H3)

reference_id (the gateway's settled-transaction ref) was not unique, so the
same successful callback — or a RefNum replayed onto another order — could
credit twice. Add a unique index (NULL until success, so pending/failed rows
don't collide) and an application-level pre-check in the callback that fails the
payment if the reference already belongs to another order. The unique index is
the hard backstop behind the check.

Regression: PaymentCallbackAmountTest::testReplayedGatewayReferenceIsRejected.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/Payment/Controller/PaymentController.php

@@ -286,6 +286,19 @@ class PaymentController extends BaseController
             return $this->redirectToFrontend($payment, false);
         }
 
+        // A gateway reference identifies exactly one settled transaction. If it
+        // already belongs to another payment, this is a replay — reject it. The
+        // unique DB index on reference_id is the hard backstop behind this check.
+        if ($result->referenceId !== '') {
+            $owner = $this->paymentRepo->findByReferenceId($result->referenceId);
+            if ($owner !== null && $owner->getId() !== $payment->getId()) {
+                $payment->setStatus(Payment::STATUS_FAILED);
+                $this->paymentRepo->save($payment);
+
+                return $this->redirectToFrontend($payment, false);
+            }
+        }
+
         $payment->setStatus(Payment::STATUS_SUCCESS);
         $payment->setReferenceId($result->referenceId);
         $this->paymentRepo->save($payment);

src/Payment/Entity/Payment.php

@@ -58,7 +58,7 @@ class Payment
     #[ORM\Column(name: 'gateway_token', type: 'string', length: 255, nullable: true)]
     private ?string $gatewayToken = null;
 
-    #[ORM\Column(name: 'reference_id', type: 'string', length: 255, nullable: true)]
+    #[ORM\Column(name: 'reference_id', type: 'string', length: 255, nullable: true, unique: true)]
     private ?string $referenceId = null;
 
     #[ORM\Column(name: 'frontend_address', type: 'string', length: 500, nullable: true)]

src/Payment/Repository/PaymentRepository.php

@@ -54,6 +54,11 @@ class PaymentRepository extends ServiceEntityRepository
         return $this->findOneBy(['orderId' => $orderId]);
     }
 
+    public function findByReferenceId(string $referenceId): ?Payment
+    {
+        return $this->findOneBy(['referenceId' => $referenceId]);
+    }
+
     public function findPendingByAppointment(Appointment $appointment): ?Payment
     {
         return $this->findOneBy([