feat(6/19): 保留期门禁 + 支付失败持久化 + 文档校准

A1 删除/匿名化 180 天保留期门禁 (P0):
- admin/errors/codes.py + BIZ_ORDER_RETENTION_NOT_EXPIRED (E02002) -> HTTP 409
- admin/config.py + retention_days / GAOKAO_RETENTION_DAYS (默认 180)
- admin/routes/orders.py + _assert_retention_expired 守卫
- data/orders/deletion_service.py + RETENTION_GUARDED_STATUSES
- admin/tests/test_order_deletion.py + _expire_retention_window + 3 测试

B1 支付失败 webhook 持久化 (P1):
- data/payments/dao.py + failed_at/failure_reason/provider_trade_no/callback_payload
- data/payments/models.py + PaymentRecord 新字段
- data/payments/service.py handle_webhook 失败分支持久化
- data/payments/tests/test_webhook.py test_handle_webhook_persists_failed_status

A2 文档校准 (P1):
- README / PRD / ROADMAP / TECH_ARCHITECTURE 顶部对齐 6/19

B2 真相源分层 (P1):
- 6/13 整改板/执行板加历史快照前缀
- 新建 6/19 整改板/执行板
- CURRENT_STATE 顶部加 6/19 增量段 (在 6/13 真相源之上叠加)

dev-verify: 1175 passed (A1+B1+A2+B2) -> 1179 passed (+ T12-C),
coverage overall=85.05% / core=100%

data/orders/deletion_service.py

@@ -24,6 +24,20 @@ CREATE INDEX IF NOT EXISTS idx_order_deletion_audits_order_id ON order_deletion_
 """
 
 
+# 状态 → 触发保留期门禁的子集。
+# pending 视为未付款,可由后台直接清理(避免未支付订单卡在 retention 周期里);
+# paid/serving/delivered/completed/refunded 才进入"服务完成后 180 天"口径。
+# 实际抛 BusinessError 的 gate 在 admin/routes/orders.py 路由层 (避免 data.orders 反向依赖 admin)。
+RETENTION_GUARDED_STATUSES = frozenset({
+    "paid",
+    "serving",
+    "delivered",
+    "completed",
+    "refunded",
+})
+DEFAULT_RETENTION_DAYS = 180
+
+
 @dataclass
 class DeletionResult:
     order_id: str