Cancel a payment intent. Idempotent. Cannot be undone.

Once canceled, /pay/{id} returns 410 with a "canceled" page; the worker stops minting; webhooks are still recorded for audit but cannot revive the intent.