Use a list-specific DTO so GET /api/v1/admin/payments no longer exposes checkout URLs while get-by-id is unchanged.
Co-authored-by: Cursor <cursoragent@cursor.com>
Expose GET /api/v1/admin/payments for filtered gateway transaction listing, constrain /admin/:id to integers so /admin/payments is not mistaken for an admin id, and grant payments.list_all to ADMIN.
Co-authored-by: Cursor <cursoragent@cursor.com>