feat: add Raf-lens payment workbench expansion

[Raafet57]

Summary

Implements the Raf-lens Payment Intelligence expansion as a broad local/product scaffold:

• P0 public static workbench polish: command center, scenarios, health/scope, docs/methodology, shared findings/provenance UI.
• P1 local operational UX: in-memory session context, scenario handoff, review queue, analytics, encrypted local Vault prototype.
• P2 hosted private-pilot scaffold: offline FastAPI app with demo auth seam, SQLite, review/approval, immutable audit, readiness scoring, operator summary.
• P3 enterprise/live-data readiness scaffold: disabled connector registry for BIC/VOP/reachability/MQ/directory/payment-monitor/certified-CBPR tracks.

Gates / non-claims

• No real provider calls.
• No live BIC/VOP/reachability/payment-network integration.
• No production auth claim; pilot auth is explicitly a demo stub.
• No deploy/migration/service restart.
• Public root suite privacy boundary preserved.

Verification

• pnpm verify ✅
  • lint, format check, typecheck
  • 263 unit tests / 40 files
  • privacy audit clean
  • IBAN/BIC/CBPR data checks deterministic
  • production build
• pnpm test:e2e -- e2e/smoke.spec.ts ✅ 3 passed
• pnpm test:e2e -- e2e/workbench.spec.ts ✅ 3 passed
• cd apps/payment-intelligence-pilot && ./.venv/bin/python -m pytest -q ✅ 24 passed, 1 Starlette/httpx deprecation warning

Review notes

Claude UltraCode fanned implementation + cold-review cleanup ran locally. Hari independently reran the gates before commit and before PR open.

Still closed: merge, deploy, migration, live provider calls, service restart.