Refund Deposit

Hand back every unspent deposit still inside the window.

Order matters and is deliberate: the ledger is debited first, through _charge, which takes the wallet lock and refuses to push the balance negative. Only then is Stripe asked for the money. Doing it the other way round would leave a customer who double-clicked with two real refunds and one ledger line.

Each deposit is refunded at most once: the ledger ref is the PaymentIntent's own id with a suffix, so a retry hits the unique index instead of Stripe.