feat: IPN handler + security hardening (shared-state mutation, secret exposure)

[birkof]

Summary

Adds an authenticated IPN handler to the bundle and hardens the payment flow (security + quality findings from a review).

Security fixes

• HIGH-1 — shared-config mutation. Token payment URL /card4 is now derived from an immutable base per request via resolvePaymentUrl(); the shared NetopiaMobilPayConfiguration singleton is no longer mutated (previously accumulated /card4/card4 and leaked across requests).
• HIGH-2 — secrets in container params. Removed the dead setParameter() calls that copied private_key/signature into the container parameter bag (cleartext cache dump). A test asserts no secret parameters are registered.

New feature — IPN handler (src/Notification/)

• IpnAction enum (+ Unknown fallback), IpnResult immutable DTO (vendor Notify kept out of consumer code, money as string).
• NetopiaMobilPayIpnHandler (+interface): decrypt() opens the RSA envelope with the merchant private key (decrypt = authenticity), threading cipher/iv for aes-256-cbc on OpenSSL 3; logs only $e->getCode() on failure (no crypto-step leak); confirmResponse()/errorResponse() build <crc> via DOMDocument (XML-escaped, non-self-closing <crc></crc>).
• DI: NetopiaMobilPayConfiguration is now a single private shared service consumed by both the payment service and the public netopia_mobilpay.ipn_handler (autowired by interface alias).

Additional hardening

• MEDIUM-3 — documented that the raw-card path puts the app in PCI-DSS SAQ-D scope; hosted payment page recommended (docblock + docs).
• LOW-5 — signature config is now isRequired() (fail fast) instead of a placeholder default that defeated cannotBeEmpty().
• LOW-6 — input validation (orderId/amount/currency) at the boundary before the swallowing try/catch; declare(strict_types=1) across all bundle classes.

Test Plan

• Full suite green: vendor/bin/phpunit → 33 tests, 134 assertions
• HIGH-1 regression: payment URL from base, no /card4/card4 accumulation
• HIGH-2 regression: no secret container parameters
• IPN round-trip: real openssl_seal → decrypt; plus empty/garbage payload throw
• <crc></crc> ack non-self-closing; errorResponse sets type/code and XML-escapes message
• LOW-5: missing signature fails config processing; LOW-6: invalid orderId/amount/currency rejected
• php -l clean on all sources
• Reviewer: confirm <crc></crc> ack format against a live Netopia sandbox before production use