Refresh a storefront payment

Reconciles one tenant-scoped booking deposit from the absolute payment state and returns only its payment and booking statuses. The route requires a storefront publishable key and the live `payments` feature; optional customer authentication is resolved before the controller. The caller must be the booking's authenticated customer or present the signed, unexpired payment capability minted with checkout in the `X-Lynkow-Payment-Capability` header. Missing, malformed, foreign, and unauthorized ids all return the same forbidden response, and a bare payment id never authorizes this read. > **Note:** This endpoint requires the e-commerce feature to be enabled on your site.