Deploy payments/dev dataplane (Layer 2), mirroring catalog/customers

Real Konnect Control Plane dc3b2a36-e2ad-4da1-a142-022d0ce6d94e, PAT
in Vault (kong-v2/payments/dev/konnect-pat). Replaces the TODO stubs
with the proven gateway-kustomization.yaml + externalsecret.yaml +
policies-kustomization.yaml pattern. IdP is the local Keycloak from
the start (platform default now, see STATUS.md 15/16), not the VPS.

Layer 3 (payments-api) not started — Gateway answers 404, nothing
routed yet.

dev/api-gateway/externalsecret.yaml

@@ -0,0 +1,27 @@
+# Real PAT lives only in Vault (secrets/kong-v2/payments/dev/konnect-pat),
+# never in git, never manually kubectl-applied. refreshInterval controls how
+# often ESO re-checks Vault and re-syncs the K8s Secret if the value
+# changed there — rotation becomes "update Vault", nothing to touch in the
+# cluster.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: payments-dev-konnect-auth
+  namespace: payments
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-kong-v2
+  target:
+    name: payments-dev-konnect-auth
+    template:
+      metadata:
+        labels:
+          konghq.com/credential: konnect
+          konghq.com/secret: "true"
+  data:
+    - secretKey: token
+      remoteRef:
+        key: kong-v2/payments/dev/konnect-pat
+        property: token