feat: add POST /api/payment/{orderId}/pay mock payment endpoint

- PaymentController: @RestController at /api/payment, requires
  authentication (covered by SecurityConfig.anyRequest().authenticated())
- POST /{orderId}/pay: calls orderService.markAsPaid(orderId) which
  sets status=PAID and amountPaid=49.00, returns updated OrderResponse
- No Stripe integration yet — pure mock simulating what a successful
  Stripe webhook callback would do in Phase 1
- toResponse() mapper reuses the same OrderResponse structure as
  OrderController for consistent API shape

backend/src/main/java/se/bilhalsning/controller/PaymentController.java

@@ -0,0 +1,38 @@
+package se.bilhalsning.controller;
+
+import lombok.RequiredArgsConstructor;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+import se.bilhalsning.dto.OrderResponse;
+import se.bilhalsning.entity.Order;
+import se.bilhalsning.service.OrderService;
+
+import java.util.UUID;
+
+@RestController
+@RequestMapping("/api/payment")
+@RequiredArgsConstructor
+public class PaymentController {
+
+    private final OrderService orderService;
+
+    @PostMapping("/{orderId}/pay")
+    public ResponseEntity<OrderResponse> pay(@PathVariable UUID orderId) {
+        Order order = orderService.markAsPaid(orderId);
+        return ResponseEntity.ok(toResponse(order));
+    }
+
+    private OrderResponse toResponse(Order order) {
+        return new OrderResponse(
+                order.getId(),
+                order.getPlate(),
+                order.getStatus().getValue(),
+                order.getTrackingId(),
+                order.getAmountPaid(),
+                order.getCreatedAt()
+        );
+    }
+}