Cancel a payment intent. Idempotent. Cannot be undone.

Once canceled, /pay/{id} returns 410 with a "canceled" page; the worker
stops minting; webhooks are still recorded for audit but cannot revive
the intent. Returns 404 if the transaction does not exist or belongs to
a different client, and 409 if it already succeeded (a successful
payment can never be canceled).