GET /v1/payments/{id}/timeouts observability endpoint

There is currently no way to see, via the API, whether a payment has a pending timeout scheduled, what state it's for, or when it's due. The only way to answer "is this payment about to auto-expire, and when?" is to query the payment_timeouts table directly. This is genuinely useful observability for exactly the kind of question ("why did this payment expire when it did?") that comes up during an incident.

The route (GET /v1/payments/{id}/timeouts), handler, response DTO, and a PendingTimeout model type all already exist -- only the actual SQL query in Store.ListTimeouts is missing (a panicking stub).

go run ./cmd/paystate curl -s localhost:8080/v1/payments/<id>/timeouts

-> 500 Internal Server Error, panic logged: Store.ListTimeouts not implemented

This mirrors Store.Events (the audit-trail query) almost exactly -- same shape, different table. It's a genuinely useful piece of observability for exactly the kind of question ("why did this payment expire when it did?") that comes up during an incident.

Look at Store.Events right below where Store.ListTimeouts is defined in internal/payment/store.go for the pattern: a pool.Query against payment_timeouts WHERE payment_id = $1 ORDER BY ..., then loop rows.Next() and Scan into a PendingTimeout (declared in internal/payment/models.go) per row. The columns you need are already named consistently: id, state, version, deadline_at, timeout_event, status.