[Backend] Refund endpoint (M1 requestRefund)

[MahadAhmed25]

Implement refund flow: validate refund request (payment id, amount), call Stripe refund API, update payment/refund status. Expose e.g. POST /api/payments/refund. Restrict to admin or defined role per MIS.