Deploy payments/dev dataplane (Layer 2), mirroring catalog/customers

Real Konnect Control Plane dc3b2a36-e2ad-4da1-a142-022d0ce6d94e, PAT
in Vault (kong-v2/payments/dev/konnect-pat). Replaces the TODO stubs
with the proven gateway-kustomization.yaml + externalsecret.yaml +
policies-kustomization.yaml pattern. IdP is the local Keycloak from
the start (platform default now, see STATUS.md 15/16), not the VPS.

Layer 3 (payments-api) not started — Gateway answers 404, nothing
routed yet.

README.md

@@ -1,10 +1,41 @@
 # dataplane-payments
 
 Layer 2 (Gateway infrastructure) for the **payments** bounded context
-(domain team: payments). `DataPlane`, `KonnectExtension`, certs (cert-manager),
-secrets (External Secrets Operator) — one Control Plane per environment,
-referenced by ID (created by `../konnect-platform`, never recreated here).
+(domain team: payments) — one Control Plane per environment, referenced by
+ID (created manually in Konnect for now, never recreated here:
+`dc3b2a36-e2ad-4da1-a142-022d0ce6d94e` for `dev`).
 
-Content is generated and PR'd automatically when the matching Control
-Plane is created via the self-service flow in `../konnect-platform` —
-never hand-edited directly.
+Same `gateway-kustomization.yaml` / `externalsecret.yaml` /
+`policies-kustomization.yaml` three-file pattern as `dataplane-catalog` and
+`dataplane-customers` — see `dataplane-catalog/README.md` for the full
+explanation of each file's role, identical here, not repeated. Actual
+resource template lives in `../k8s-platform/dataplane-template/` and
+`../k8s-platform/dataplane-globalpolicy-template/`, this repo only holds
+what's specific to `dev/api-gateway/`.
+
+**IdP**: `https://keycloak.sttlab.local/realms/classic-models` (local
+in-cluster Keycloak), same platform-wide default as `catalog`/`customers`
+— see `../STATUS.md` sections 15/16. `JWT_AUDIENCE_WHITELIST` is
+`["payments-api"]` only so far; no `payments-api` Keycloak client/audience
+scope exists yet either (Layer 3 not built) — that whitelist entry is
+forward-looking, matches nothing real yet.
+
+**Only `dev/` is real.** `staging/api-gateway/` and `prod/api-gateway/`
+still hold the original TODO placeholder files, not converted, not
+deployed, no Control Plane created for them yet.
+
+**This is Layer 2 (Gateway infrastructure) only — no API is actually
+reachable through it.** `Gateway payments-dev`: `Programmed: True`,
+DataPlane pod running, TLS cert issued, DNS entry added to
+`coredns-custom` (same manual per-domain step documented in
+`../STATUS.md` section 17 — not automatic). Smoke-tested: `404` (Gateway
+answers, nothing routed — correct, expected). No Layer 3 repo
+(`../payments-api`) exists yet; when it does, follow `../customers-api`'s
+structure as the reference, not `../catalog-api`'s (customers is the more
+recently corrected/simpler pattern — REST-only until an MCP layer is
+actually needed, single merged MCP route if one is added — see
+`../STATUS.md` section 18 for why).
+
+Self-service pipeline (`../konnect-platform` generating this content
+automatically) does not exist yet — still a stub per `../STATUS.md`.
+Everything here is hand-maintained.