Payment Phase R: PAYONE-Integration entflechten (R1–R7 + Review)

Strangler-Refactoring der PAYONE-Zahlungslogik in eine testbare
Service-Schicht, ohne Verhalten in Checkout/Cron/IPN zu ändern.

Neue Services (app/Services/Payment/Payone):
- PayonePaymentService (+ PayonePaymentResult-DTO) für CC-/SEPA-Check
  und Abo-Abbuchung
- PayoneRequestBuilder, PaymentMethodResolver, PayoneMethodConfig
- PayoneTransactionRecorder: zentrale PaymentTransaction-Erstellung
  (API-Response, Invoice, Webhook) inkl. PCI-Redaction (cardpan/cardcvc2)
- PayoneWebhookHandler (+ PayoneWebhookResult): IPN/TSOK-Logik aus
  Api\PayoneController; response('TSOK') statt echo/exit
- PayoneTransportException + Handler-Mapping (403) statt abort() im Service

Hotfixes (R1): var_dump/exit & bare exit() entfernt, Log-Redaction.

Security (R-Review):
- PAYONE_KEY_HASH (MD5-Hash, kein Klartext) mit Boot-Hard-Fail; schließt
  zugleich die ''-Webhook-Bypass-Lücke. Artisan-Command payone:hash-key
  (verdeckte Eingabe, optional --write) zur Hash-Erzeugung.
- Webhook: txaction Pflichtfeld, mode-Fallback auf payment->mode.

Pay\PayoneController ist @deprecated-Fassade (614 → 328 Zeilen),
delegiert an Services via Container-Singleton.

Migration: fehlende Spalte shopping_payments.carddata nachgezogen.

Tests: 47 grün (PayonePaymentService, Recorder, Webhook, Resolver,
TransportException, hash-key). End-to-End im Test-System verifiziert
(siehe dev/2026-06-09-payments).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/Cron/UserMakeOrder.php

@@ -3,11 +3,11 @@
 namespace App\Cron;
 
 use App\Http\Controllers\Pay\PayoneController;
-use App\Models\PaymentTransaction;
 use App\Models\ShoppingOrder;
 use App\Models\ShoppingOrderItem;
 use App\Models\UserAbo;
 use App\Services\AboOrderCart;
+use App\Services\Payment\Payone\PayoneTransactionRecorder;
 use Illuminate\Support\Facades\Log;
 use Yard;
 
@@ -79,7 +79,7 @@ class UserMakeOrder
             \Log::info('Response: '.json_encode($response));
             // $response = $this->pay->ResponseData(true);
 
-            Log::info('Zahlungsvorgang abgeschlossen für UserAbo ID: '.$this->userAbo->id.', Status: '.($response->status ?? 'unbekannt'));
+            Log::info('Zahlungsvorgang abgeschlossen für UserAbo ID: '.$this->userAbo->id.', Status: '.(is_array($response) ? ($response['status'] ?? 'unbekannt') : 'unbekannt'));
 
             return $response;
         } catch (\Exception $e) {
@@ -100,19 +100,12 @@ class UserMakeOrder
             return;
         }
 
-        PaymentTransaction::create([
-            'shopping_payment_id' => $shoppingPayment->id,
-            'request' => 'authorization',
-            'txid' => $responseData['txid'] ?? 0,
-            'userid' => $responseData['userid'] ?? $this->userAbo->payone_userid ?? 0,
-            'status' => $responseData['status'],
-            'txaction' => $responseData['txaction'] ?? null,
-            'transmitted_data' => $responseData,
-            'errorcode' => $responseData['errorcode'] ?? null,
-            'errormessage' => $responseData['errormessage'] ?? null,
-            'customermessage' => $responseData['customermessage'] ?? null,
-            'mode' => $shoppingPayment->mode,
-        ]);
+        PayoneTransactionRecorder::recordFromResponse(
+            $shoppingPayment,
+            'authorization',
+            $responseData,
+            (int) ($this->userAbo->payone_userid ?? 0),
+        );
     }
 
     public function getShoppingPayment()