feat(dimentorin): Midtrans payment provider (sandbox VA + QRIS)

- Env: MIDTRANS_MERCHANT_ID / CLIENT_KEY / SERVER_KEY (masked in Debug)
- midtrans_provider: Core API v2/charge for bank_transfer (VA BCA) and qris (gopay)
- PaymentServiceImpl: when MIDTRANS_MERCHANT_ID set -> provider=midtrans, external_ref = real VA number / QR string; falls back to manual refs otherwise
- SMTP: Google app password working (send-otp 200, OTP stored)
- E2E verified (sandbox): VA externalRef=47329093597744219189188, QRIS qr_string EMVCo, confirm->paid
- Credentials stored in BWS (dimentorin_midtrans_*, dimentorin_smtp_*)

imphnen-libs/src/environment/mod.rs

@@ -34,6 +34,9 @@ pub struct Env {
 	pub google_client_secret: String,
 	pub google_redirect_url: String,
 	pub cdn_url: String,
+	pub midtrans_merchant_id: String,
+	pub midtrans_client_key: String,
+	pub midtrans_server_key: String,
 	pub cors_allowed_origins: Vec<String>,
 }
 
@@ -73,6 +76,9 @@ impl std::fmt::Debug for Env {
 			.field("google_client_secret", &"***")
 			.field("google_redirect_url", &self.google_redirect_url)
 			.field("cdn_url", &self.cdn_url)
+			.field("midtrans_merchant_id", &self.midtrans_merchant_id)
+			.field("midtrans_client_key", &"***")
+			.field("midtrans_server_key", &"***")
 			.field("cors_allowed_origins", &self.cors_allowed_origins)
 			.finish()
 	}
@@ -198,6 +204,9 @@ pub static ENV: Lazy<Env> = Lazy::new(|| {
 			"http://localhost:8000/api/v1/auth/google/callback",
 		),
 		cdn_url: get_env_with_warning("CDN_URL", "https://cdn.asepharyana.tech"),
+		midtrans_merchant_id: get_env_with_warning("MIDTRANS_MERCHANT_ID", ""),
+		midtrans_client_key: get_env_with_warning("MIDTRANS_CLIENT_KEY", ""),
+		midtrans_server_key: get_env_with_warning("MIDTRANS_SERVER_KEY", ""),
 		cors_allowed_origins: get_env_with_warning(
 			"CORS_ALLOWED_ORIGINS",
 			"https://gacha.imphnen.dev,https://imphnen.dev,https://dimentorin.imphnen.dev,https://backoffice.imphnen.dev,https://hackathon.imphnen.dev,https://qr.imphnen.dev,https://infra.imphnen.dev",