[accounting][payment] add order lookup and refund flow

[martinjt]

Changes

Lays the groundwork for a future order-management UX (e.g. a chatbot that
looks up orders and requests refunds). The demo currently has no read
path for orders and no refund flow.

• Read-only OrderService on accounting (GetOrdersByEmail,
  GetOrder); accounting becomes an ASP.NET Core gRPC host alongside
  its existing kafka consumer. accounting."order" and the OrderResult
  proto gain email, user_id, transaction_id, total_cost,
  order_status, timestamps, and refund_transaction_id.
• PaymentService.Refund rpc + handler, gated by a new
  paymentServiceRefundFailure flagd flag (mirrors the existing
  paymentFailure pattern). On success, payment publishes a
  RefundResult to a new refunds Kafka topic; accounting's consumer
  subscribes to it and marks the order refunded (idempotent on replay).
• Frontend gets gateways + API routes for orders
  (GET /api/orders[/:id], POST /api/orders/:id/refund). The refund
  route fetches the order from accounting to validate ownership/status,
  then calls payment directly; the order's status flips asynchronously
  via the kafka event.
• order-expiry sidecar in docker-compose.yml reuses
  ${POSTGRES_IMAGE} to delete orders older than 48h on a loop
  (configurable). The Helm equivalent is a CronJob with the same
  one-liner — no new image to publish.

No order-management UX is included here; that lands in a follow-up.

Merge Requirements

For new features contributions, please make sure you have completed the following
essential items:

• CHANGELOG.md updated to document new feature additions
• Appropriate documentation updates in the docs
• Appropriate Helm chart updates in the helm-charts

[linux-foundation-easycla]

• ✅ login: martinjt / name: Martin Thwaites (65e1d4d)
• ❌ The email address for the commit (65e1d4d) is not linked to the GitHub account, preventing the EasyCLA check. Consult this Help Article and GitHub Help to resolve. (To view the commit's email address, add .patch at the end of this PR page's URL.) For further assistance with EasyCLA, please submit a support request ticket.

One or more co-authors of this pull request were not found. You must specify co-authors in commit message trailer via:

Co-authored-by: name <email>

Supported Co-authored-by: formats include:

1. Anything <id+login@users.noreply.github.com> - it will locate your GitHub user by id part.
2. Anything <login@users.noreply.github.com> - it will locate your GitHub user by login part.
3. Anything <public-email> - it will locate your GitHub user by public-email part. Note that this email must be made public on Github.
4. Anything <other-email> - it will locate your GitHub user by other-email part but only if that email was used before for any other CLA as a main commit author.
5. login <any-valid-email> - it will locate your GitHub user by login part, note that login part must be at least 3 characters long.

Alternatively, if the co-author should not be included, remove the Co-authored-by: line from the commit message.

Please update your commit message(s) by doing git commit --amend and then git push [--force] and then request re-running CLA check via commenting on this pull request:

/easycla

[julianocosta89]

Hey @martinjt 18k LOC is not easily reviewable by humans.
If we want to have that in, let's break that down into smaller chunks and go service by service. Otherwise this may get out of hand.

[martinjt]

Huh, sorry, that was supposed to be a draft while I paired it down.

[julianocosta89]

TBF it is a draft 😅

[martinjt]

Haha, well, my plan was to judge the acceptability of the premise then workout how to get it in. Would love your thoughts on it.

[puckpuck]

I think adding a refund workflow makes sense. Will this eventually add new services/components as well?

[github-actions]

This PR was marked stale due to lack of activity. It will be closed in 7 days.

[github-actions]

This PR was marked stale due to lack of activity. It will be closed in 7 days.

[github-actions]

Closed as inactive. Feel free to reopen if this PR is still being worked on.