Observability: alert on settlement failures and avoid leaking internals in errors

[rahulsainlll]

For a production payment system we need visibility into failures and must ensure error responses don't leak internal details.

Proposal

• Emit metrics + alerts for: settlement failures, upstream error rates, rate-limit hits, and 5xx rates on the gateway.
• Audit gateway/API error responses to confirm no stack traces, XDR, or internal identifiers are returned to callers (return stable, generic messages; log details server-side).
• Add a lightweight structured-logging convention for the payment path (request id, capability slug, payer, tx hash).

Priority: medium (ops).