Reserve an MPP deposit intent's refund (settle worker, service key)

Service-key only (enforcer-mpp-settler). Always mode=reserve: reserves the (intent, refund) action and returns the plan with action_id. v3 sends nothing. dry_run=false or any mode but reserve is 400 send_not_allowed. Refused (409) unless the intent is underpaid, overpaid, parked or expired, and 409 refund_to_contract when the refund address has code or is a forwarder. Idempotent per intent. The actor recorded is service:<label>.