feat: Open Payments aggregator mock for acctest

Tiny in-memory stand-in for the Open Payments PSD2/BerlinGroup
aggregator, extracted from acctest where it lived inline (which
couldn't docker-build on the self-hosted CI runner — /.docker/buildx
was read-only). A separate repo:

- lets the mock build + publish its image via the standard shiny CI
  flow, pulled like any other service
- keeps acctest focused on test infra, not service source
- gives the mock its own versioned release lifecycle

**Endpoints** (see README for the full list)
- OAuth: POST /token → canned bearer token.
- AIS: aspsps catalog, consent lifecycle, /authorize self-redirect SCA
  stub, payment + card accounts + transactions.
- PIS: sepa-credit-transfers initiate + status (RCVD → PDNG → ACSC;
  creditor name 'REJECT ME' → RJCT), signing baskets (RCVD → ACCP →
  ACSC; basket ACSC advances all linked payments).
- Admin: /admin/* endpoints let acctest force deterministic
  transitions, seed transactions, reset state, override consent
  expiry.

**CI**
Standard shiny ci.yaml: check (go build + vet), vulnerabilities
(govulncheck), build (buildtools publishes oci.unbound.se/shiny/
openpayments-mock:${COMMIT}). No deploy job — image is consumed by
acctest only.

**k8s/deploy.yaml**
Deployment + Service on port 8080 with /healthz readiness/liveness.
acctest's infra manifest will reference the published tag.

k8s/deploy.yaml

@@ -0,0 +1,61 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: openpayments-mock
+  labels:
+    app.kubernetes.io/name: openpayments-mock
+  annotations:
+    kubernetes.io/change-cause: "${TIMESTAMP} Deployed commit id: ${COMMIT}"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: openpayments-mock
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: openpayments-mock
+        app.kubernetes.io/instance: shiny
+    spec:
+      containers:
+      - name: openpayments-mock
+        image: oci.unbound.se/shiny/openpayments-mock:${COMMIT}
+        imagePullPolicy: IfNotPresent
+        ports:
+        - name: http
+          containerPort: 8080
+        env:
+        - name: PUBLIC_BASE_URL
+          value: "https://openpayments-mock"
+        resources:
+          requests:
+            cpu: "10m"
+            memory: "20Mi"
+          limits:
+            memory: "64Mi"
+        readinessProbe:
+          httpGet:
+            path: /healthz
+            port: 8080
+          periodSeconds: 2
+          failureThreshold: 10
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: 8080
+          periodSeconds: 10
+          failureThreshold: 3
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: openpayments-mock
+  labels:
+    app.kubernetes.io/name: openpayments-mock
+spec:
+  selector:
+    app.kubernetes.io/name: openpayments-mock
+  ports:
+  - name: http
+    port: 8080
+    targetPort: 8080