PRE-3682: scope API client creation to the payment method

[adumont-payplug]

Description

PayPlugApiClientFactory::create(string $factoryName) resolves its gateway config with
findOneBy(['factoryName' => $factoryName]). Since PRE-3628 several enabled GatewayConfig
rows may share a factoryName — one per channel — so Doctrine returns an arbitrary one and the
plugin can sign a request for channel A with channel B's account credentials.

This PR routes the remaining direct callers through the correctly-scoped
createForPaymentMethod(PaymentMethodInterface) and removes create() from
PayPlugApiClientFactoryInterface, so the compiler — not review — is the guard against the
ambiguous path being reintroduced.

• IpnAction and IntegratedPaymentController now use createForPaymentMethod(). The latter
  also moved off the concrete final PayPlugApiClientFactory type-hint, which made it untestable.
• Five further classes type-hinted the concrete factory and would have leaked straight past the
  new guard (OneClickAction, PaymentStateResolver, CaptureAuthorizedPaymentProcessor,
  IsOneyEnabledValidator, PayplugPermissionValidator). All already called
  createForPaymentMethod(), so they now depend on the interface. lint:container passes.
• SupportedMethodsProvider's two resolvers take the GatewayConfigInterface instead of the
  ambient $factoryName; shared suffix logic extracted into paymentMethodKey().
• The Behat mocker implements the new interface.

Not included — create() stays on the concrete class, marked @internal. The ticket assumed
4 call sites; there are 7 more, reaching it through the payplug_sylius_payplug_plugin.api_client.*
singletons in client.xml (<factory … method="create"/>), #[Autowire]d into OneyChecker,
CardController, OneyRulesExtension, ShowMeaExtension, OneySimulationDataProvider,
ApplePayPaymentProvider and RefundUnitsCommandCreatorDecorator. Three of them have no payment
method in scope at all and need a design decision, so that half stays open on PRE-3682.
CLAUDE.md described these singletons as dead wiring; corrected here, and PRE-3684 corrected too.

⚠️ Base branch: stacked on fix/PRE-3683_per_config_account_memo, not develop — PRE-3683
already removed the SupportedMethodsProvider create() calls this PR builds on.

Motivation: a cross-channel credential leak — a multi-boutique merchant's payment can be
created, captured or refunded against another channel's PayPlug account.

Related issue(s): PRE-3682 — do not auto-close, one criterion stays open (see above).

---

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• 💥 Breaking change (fix or feature that causes existing functionality to change and that could impact other libs)
• 🔒 Security fix

---

Checklist

Code Quality

• Code is linted and formatted
• No unnecessary commented-out code or debug logs
• No hardcoded values (use env variables or config)

Testing

• Unit tests added / updated
• New/changed code is covered by tests — SonarCloud Quality Gate (coverage on new code) passes on the sonarcloud CI job

Security & Ops

• No sensitive data or secrets introduced
• Logging and error handling are appropriate

[claude]

Claude Code Review

Claude Code Review is paused for this repository. To reconnect it, an admin of this repository's GitHub organization (or the account owner, for personal repositories) who can also manage your Claude organization's Code Review settings needs to re-link GitHub in Code Review settings. This is a one-time step.

_{Tip: disable this comment in your organization's Code Review settings.}