Build payments-api REST layer (Layer 3), mirroring customers-api

6 routes over Payment, composite key (customernumber + checknumber),
proxying to classic-models-api. openid-connect with RFC 8693 token
exchange to classic-models-api audience, rate-limiting, proxy-cache,
audit-log — same structure as customers-api's REST layer.

Keycloak (local): payments-api-audience client scope + payments-api
resource client added, attached to kong-token-exchange-broker's
default scopes. No dedicated protocol mappers on payments-api
itself, same practice as customers-api/mcp-customers.

No MCP layer — same as customers-api, not needed yet.

kong/kustomization.yaml

@@ -0,0 +1,14 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - rest/service.yaml
+  - rest/routes.yaml
+  - rest/path-rewrite.yaml
+  - rest/path-rewrite-bindings.yaml
+  - rest/kongplugin.yaml
+  - rest/rate-limiting.yaml
+  - rest/proxy-cache.yaml
+  - rest/audit-log.yaml
+  - rest/audit-log-body-capture.yaml
+  - rest/audit-log-body-capture-bindings.yaml
+  - rest/pluginbindings.yaml