Only auto-capture an approved authorize in ConfirmPaymentAction

[loevgaard]

Fixes robustness finding R1 of #57.

Problem

ConfirmPaymentAction gated its auto-capture on OperationType::Authorize === $latestOperation->type() — the operation type alone. A rejected authorize (declined card — a routine event in the payment window, and Quickpay sends a callback for it) and a still-pending authorize both have that type, so they fell through to the amount check, where Operations::authorizedAmount() returns 0, the comparison failed, and the action threw LogicException.

Thrown from the notify path, that 500s the endpoint — and Quickpay then retries a callback that can never succeed.

Fix

Gate on Operations::isApprovedOfType($latestOperation, OperationType::Authorize): a not-approved authorize is nothing to confirm, so the callback completes quietly (the balance is still persisted). The amount-mismatch throw for an approved authorize is kept — that is a genuine anomaly worth surfacing.

Tests

• ConfirmPaymentActionTest: rejected authorize → no capture, no throw; pending authorize → no capture, no throw.
• NotifyActionTest: full callback flow for a declined payment with auto_capture on completes without error.
• ApiTestTrait::operation() now supports pending/null status-code fixtures — the shape every asynchronous operation has until Quickpay finishes it, previously absent from the whole suite.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.43%. Comparing base (6122f5f) to head (5cfe38b).

Additional details and impacted files

@@            Coverage Diff            @@
##                2.x      #58   +/-   ##
=========================================
  Coverage     97.43%   97.43%           
  Complexity      126      126           
=========================================
  Files            14       14           
  Lines           351      351           
=========================================
  Hits            342      342           
  Misses            9        9           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.