feat(permissions): carve out dedicated payments resource

Payments (deposit / balance / refund records on an interest) used to
share `invoices.record_payment`, which forces a port that doesn't
issue invoices at all to still navigate the invoicing permission
group to grant its sales reps payment-recording rights. Splitting
the resource lets admins gate the two surfaces independently.

The new resource has three actions:
  - view   — gates the UI affordance (API reads still go through
             `interests.view`)
  - record — POST / PATCH a payment
  - delete — DELETE a payment record

Seed maps updated for all six system roles; existing role rows +
per-user permission overrides are backfilled by migration 0064 so
upgrades don't silently lose access. Two call sites (POST /interests/
[id]/payments, PATCH /payments/[id]) → payments.record; one
(DELETE /payments/[id]) → payments.delete. The PermissionGates on the
payments-section UI swap to the new keys.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/db/schema/users.ts

@@ -58,6 +58,18 @@ export type RolePermissions = {
     record_payment: boolean;
     export: boolean;
   };
+  /**
+   * Standalone payments resource (deposit / balance / refund records on
+   * an interest). Carved out from `invoices.record_payment` so a port
+   * that does not use the invoicing module at all can still grant
+   * payment-recording rights to sales reps. `view` follows interests.view
+   * at the route level — this gate only governs the UI affordance.
+   */
+  payments: {
+    view: boolean;
+    record: boolean;
+    delete: boolean;
+  };
   files: {
     view: boolean;
     upload: boolean;