refactor: replace direct WeChat/Alipay with unified pay-api gateway

Switch from direct WeChat Pay / Alipay integrations to the unified
宇之然 pay-api gateway (HMAC-SHA256 auth). Removes wechat_pay.py,
keeps PaymentGateway abstraction, adds UnifiedPayService. Simplifies
payment.py create_order to {plan, pay_type} params. Single webhook
endpoint replaces separate WeChat/Alipay notify handlers.

backend/app/core/csrf.py

@@ -23,7 +23,7 @@ CSRF_PROTECTED_METHODS = {"POST", "PUT", "PATCH", "DELETE"}
 # Endpoints that should skip CSRF protection (e.g., webhook endpoints)
 CSRF_SKIP_ENDPOINTS = [
     "/api/v1/webhook/",
-    "/api/v1/payment/notify",
+    "/api/v1/payment/webhook",
     "/api/v1/whatsapp/webhook",
 ]