Fix internal-detail leak in Setup.php's error handling

[jules-paystack]

Summary

• Controller/Payment/Setup.php passed raw ApiException::getMessage() (built from curl_error() and Paystack's raw API response body — can carry internal hostnames, TLS detail, gateway-side state) directly to the customer-facing checkout failure page. Same leak class D5 already closed on Callback.php; missed here.
• Found by diffing the now-merged fix/r2.1-settlement-gate reconciliation (PR Reconcile settlement-gate: full accept-side verification, D7/D8/D12 fixes #77) against master after the fact, to confirm everything from that abandoned branch had actually been ported — it hadn't, in this one spot.
• Fix: log the raw detail (context array, not string concatenation, so an embedded newline can't forge log lines) and keep writing it to order status history (admin-only); the customer now gets a fixed, safe string.
• Also added a bare catch (\Throwable) matching Callback.php's D5 fix — the ApiException-only catch left every other exception processAuthorization() can throw (a missing store URL, a malformed Paystack response, a save failure) uncaught, which in developer-mode stores would print the raw message + trace to the browser.
• Adversarial (security-critic) review of this diff via mutation testing found the same class of gap in the test itself (an exact-equality guard that a "give the customer a bit more detail" edit could slip past while staying green) — tightened to str_contains.

Test plan

• Test/Unit/vendor/bin/phpunit -c phpunit.xml --no-coverage — 303 tests, 592 assertions, all green
• New test for the \Throwable path, confirming a non-ApiException throw also shows the safe message, not its own text
• Security-critic review of this diff, verified via mutation testing that the test assertions are actually discriminating

🤖 Generated with Claude Code