README: teach the Quickpay model — install text, TOC, Concepts, callback best practices, recipes; docblock polish

[loevgaard]

Part of #10 (findings 11–14). Docs only (README + two docblocks); no behaviour change.

Merge this one last. The TOC and the recipes reference APIs added by #12 (findByOrderId, PaymentsQuery), #13 (result helpers), #14 (deleteLink, escape hatch section), #15 (testing section), #16 (cache:), #17 (handleRaw headers / handleGlobals), #18 (TransportException) and #19 (variables(), Shopsystem). It's based on 1.x, so expect small README merge conflicts with those PRs' own README hunks — happy to rebase once they're in.

What

• Installation — a cold composer require into a fresh project showed the old text was misleading: with the php-http/discovery plugin allowed, Composer auto-installs symfony/http-client + nyholm/psr7; with it disabled, the install succeeds silently and new Client() throws php-http's NotFoundException at runtime. The section now says all of that.
• Table of contents.
• "Concepts — five things to know about Quickpay" — the mental model the SDK docs assumed but never taught: the two keys / no sandbox; amounts in minor units; a payment as a ledger of operations (state, accepted, balance, the qp_status_code families, linked to Quickpay's errors appendix); async operations; and the continue_url redirect is not proof of payment. State semantics checked against Quickpay's own payments guide (create → initial; authorized via link → accepted: true, state: new) and live data.
• Link flow — the continueUrl warning as a call-out (promoted from examples/e2e/README.md, where it was hiding).
• "Handling callbacks robustly" — body = whole payment (not an event), retried up to 24× → idempotency on Operation::$id, respond fast, per-payment ordering only, why 403/400 (not 2xx/5xx) on rejects, accountId/body. Sourced from Quickpay's callback docs.
• Recipes — "Checkout, end to end" (find-or-create → link → callback → capture, using the new helpers) and "Wiring in Symfony" (services.yaml with env keys + a Valinor cache).
• Docblocks — Link: createLink() returns only {url} (verified in the spec: PaymentLinkUrl), the full link lives on the payment; PaymentsEndpoint: the async-202 explanation now lives once on the class and the four operation methods point to it instead of repeating it.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.03%. Comparing base (d94be92) to head (410f7e0).

Additional details and impacted files

@@            Coverage Diff            @@
##                1.x      #20   +/-   ##
=========================================
  Coverage     99.03%   99.03%           
  Complexity      192      192           
=========================================
  Files            26       26           
  Lines           517      517           
=========================================
  Hits            512      512           
  Misses            5        5           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.