Payer soft signal that a bank transfer was sent (unauthenticated)

AR charge rail (Stage 5). UNAUTHENTICATED; rate-limited per-IP and per-token. Records ONE durable ach/pending invoice_payments row (amount = outstanding at signal time; repeated clicks are a no-op) so the merchant can see the claim. It NEVER marks the invoice paid and NEVER changes lifecycle status — the merchant reconciles the real deposit. The response is identical whether or not a row was written. Same uniform-404 token gate as the GET.