Surface unresolved critical payment states as admin notifications

Adds the scan-critical-payment-logs job (daily 2:45am) that surfaces stale pending payments/till-sales and refunds at the retry cap as admin_notifications with reason='critical_payment_log' — the app has no log/alert pipeline (Gap Backlog T14), so money events that would otherwise sit in un-watched CRITICAL log lines now reach the owner's in-app notification centre. Dedup is NULL-safe (IS NOT DISTINCT FROM) and re-surfaces acknowledged-but-still-unresolved rows. Stopgap until a real alerting pipeline lands.

backend/internal/jobs/scheduler_test.go

@@ -413,8 +413,8 @@ func TestRegisterAll_RegistersExpectedJobs(t *testing.T) {
 	s := New()
 	RegisterAll(s)
 
-	if got := len(s.registry); got != 24 {
-		t.Fatalf("RegisterAll() registered %d jobs, want 24", got)
+	if got := len(s.registry); got != 25 {
+		t.Fatalf("RegisterAll() registered %d jobs, want 25", got)
 	}
 
 	registered := make(map[string]Job, len(s.registry))
@@ -492,6 +492,7 @@ func expectedJobNames() map[string]bool {
 		"cleanup-refresh-tokens":              true,
 		"sweep-square-webhook-events":         true,
 		"apply-default-hours":                 true,
+		"scan-critical-payment-logs":          true,
 	}
 }