feat: reconcile dynamic capacity lifecycle hardening

[Jordanmuss99]

Summary

This pull request supersedes #22 and #23 without rewriting either published branch.
It rebases the complete Paymenter 1.5.7 reservation, upgrade, and lifecycle
remediation onto the reviewed inventory, test-isolation, and Wiki work from
#23.

• consolidates strict paginated panel reads in PterodactylInventoryService;
• retains fail-closed resource parsing, duplicate/orphan rejection, and
  customer-safe errors;
• restores NodeCapacityPolicy, zero-as-unlimited rejection, durable checkout
  and upgrade commitments, and Paymenter-owned provisioning transitions;
• migrates the stored Pterodactyl application key and alert webhook URLs to
  encrypted storage;
• uses a process-private :temporary: SQLite test database with child-process
  isolation and permits the shared paymenter_test database only through a
  loopback MySQL/MariaDB connection;
• pins the exact audited Paymenter companion and every third-party workflow
  action and MariaDB service image to immutable commits or digests;
• restricts alert webhooks to canonical public HTTPS endpoints, revalidates all
  DNS answers at send time, disables redirects and proxies, and pins the
  connection to a validated address, including rejection of deprecated
  site-local, IPv4-compatible, ORCHID, and current IANA non-public IPv6 space;
• redacts credential-bearing webhook transport failures from structured logs,
  delivery history, and failure events;
• redacts failed Pterodactyl response bodies before internal reporting while
  retaining the HTTP status for diagnosis;
• preserves all 42 migrated Qoder pages, marks superseded deep dives as
  historical, and publishes the reconciled canonical architecture to the
  standalone Wiki.
• removes a generated OpenCode session-cache artifact that had been
  accidentally tracked despite the repository ignore rule.

Required companion

This extension branch must ship with
ObsidianNetwork/Paymenter-Obsidian-Network#24 at
d58ab220998947cbb05b3806484a69ed7a419def. Do not merge or deploy the
extension by itself.

Verification

• Cross-repository CI: https://github.com/ObsidianNetwork/dynamic-pterodactyl/actions/runs/32084798320
  • extension quality and Composer security audit;
  • PHP 8.3 and 8.4 on SQLite;
  • PHP 8.3 and 8.4 on MariaDB 11 and 12;
  • full extension suite and Paymenter provisioning seam tests.
• Companion CI:
  • tests: https://github.com/ObsidianNetwork/Paymenter-Obsidian-Network/actions/runs/32081354425
  • lint: https://github.com/ObsidianNetwork/Paymenter-Obsidian-Network/actions/runs/32081354432
  • zero npm or Composer audit findings; 15/15 JavaScript tests passed locally.
• Read-only live inventory smoke against the configured panel returned
  success=true and node_count=1; the temporary /tmp harness was removed.
• Qoder/Wiki verification: 42/42 manifest pages match, all 41 noncanonical
  pages are explicitly historical, and source links are pinned to immutable
  code checkpoints.
• Local verification: 407 tests / 1,449 assertions on PHP 8.4 with the
  process-private SQLite test database.
• Final five-lane review: goal verification, hands-on QA, code quality,
  security, and context/history all passed at
  c8dcbb6f538b1d05fc569c9d73d3cf2868069ba0.
• Exact review head 3aee81b36b2e6a443d85897779ffa489887367a0
  adds only the Pint formatting correction found by the pull-request event;
  its complete seven-job pull-request matrix passed.

Deployment state

No production deployment is included. All Mutagen sessions remain paused and
disconnected. Deployment requires backups, both repositories' migrations,
per-node capacity policies, confirmed exclusive provisioning control, a
successful real-panel staging lifecycle canary, and separate authorization.