Outright payment control

Monitor server-verified Paystack payments. Refunds are available only before physical fulfilment and require fresh Admin MFA.