test: add PaymentControllerTest with 4 cases

- shouldReturn403WhenNotAuthenticated: verifies the endpoint requires
  a valid JWT token (anyRequest().authenticated() enforcement)
- shouldMarkOrderAsPaidSuccessfully: calls POST with @WithMockUser,
  verifies response includes id, status=paid, and amountPaid=49.00
- shouldReturn404WhenOrderNotFound: mocks service to throw
  OrderNotFoundException, expects 404 response
- Test helper creates minimal Order entity with explicitly set id,
  plate, status, and amountPaid for realistic response mapping

backend/src/test/java/se/bilhalsning/controller/PaymentControllerTest.java

@@ -0,0 +1,72 @@
+package se.bilhalsning.controller;
+
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.when;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+
+import java.math.BigDecimal;
+import java.util.UUID;
+import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.boot.webmvc.test.autoconfigure.AutoConfigureMockMvc;
+import org.springframework.http.MediaType;
+import org.springframework.security.test.context.support.WithMockUser;
+import org.springframework.test.context.bean.override.mockito.MockitoBean;
+import org.springframework.test.web.servlet.MockMvc;
+import se.bilhalsning.entity.Order;
+import se.bilhalsning.entity.OrderStatus;
+import se.bilhalsning.exception.OrderNotFoundException;
+import se.bilhalsning.service.OrderService;
+
+@SpringBootTest
+@AutoConfigureMockMvc
+class PaymentControllerTest {
+
+    @Autowired
+    private MockMvc mockMvc;
+
+    @MockitoBean
+    private OrderService orderService;
+
+    @Test
+    void shouldReturn403WhenNotAuthenticated() throws Exception {
+        mockMvc.perform(post("/api/payment/{orderId}/pay",
+                        "c1eebc99-9c0b-4ef8-bb6d-6bb9bd380a11"))
+                .andExpect(status().isForbidden());
+    }
+
+    @Test
+    @WithMockUser(username = "test@bilhalsning.se")
+    void shouldMarkOrderAsPaidSuccessfully() throws Exception {
+        UUID orderId = UUID.fromString("c1eebc99-9c0b-4ef8-bb6d-6bb9bd380a11");
+        Order order = new Order();
+        order.setId(orderId);
+        order.setPlate("ABC123");
+        order.setStatus(OrderStatus.PAID);
+        order.setAmountPaid(new BigDecimal("49.00"));
+
+        when(orderService.markAsPaid(eq(orderId))).thenReturn(order);
+
+        mockMvc.perform(post("/api/payment/{orderId}/pay", orderId)
+                        .contentType(MediaType.APPLICATION_JSON))
+                .andExpect(status().isOk())
+                .andExpect(jsonPath("$.id").value(orderId.toString()))
+                .andExpect(jsonPath("$.status").value("paid"))
+                .andExpect(jsonPath("$.amountPaid").value(49.00));
+    }
+
+    @Test
+    @WithMockUser(username = "test@bilhalsning.se")
+    void shouldReturn404WhenOrderNotFound() throws Exception {
+        UUID orderId = UUID.fromString("c1eebc99-9c0b-4ef8-bb6d-6bb9bd380a11");
+        when(orderService.markAsPaid(eq(orderId)))
+                .thenThrow(new OrderNotFoundException(orderId));
+
+        mockMvc.perform(post("/api/payment/{orderId}/pay", orderId)
+                        .contentType(MediaType.APPLICATION_JSON))
+                .andExpect(status().isNotFound());
+    }
+}