retire the bunq integration

The webhook is deregistered at bunq and the callback endpoint, its parser,
default-deny classifier, dedup ledger and signature check are removed; the
code is in git history if a bank feed ever comes back. /financials keeps
reading the hand-maintained aggregates file, and sales + shop donations
stay live from the order ledger.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

deploy/catcrafts-server.service

@@ -85,14 +85,6 @@ ReadOnlyPaths=/srv/catcrafts-app /srv/catcrafts.net
 #   INVOICE_GPG_KEY=...       invoice signing (see deploy/README.md)
 #   MAIL_COMMAND=msmtp -t     order confirmation email (see deploy/README.md,
 #   MAIL_FROM=...             "Order email"); unset = no email is sent
-#   BUNQ_CALLBACK_SECRET=...  the last segment of the bunq mutation callback
-#                             URL, and what brings that endpoint into being:
-#                             unset, /api/bunq/* is a plain 404. NOT an API
-#                             key — no bunq key belongs on this box, because
-#                             one can initiate payments (deploy/README.md,
-#                             "The bunq mutation callback")
-#   BUNQ_CALLBACK_PUBKEY=...  path to bunq's server public key in PEM; set it
-#                             to REQUIRE a valid RSA-SHA256 body signature
 # The '-' prefix makes the file optional: without it the server starts with
 # payments off and the shop renders but refuses checkout — degraded, not down.
 EnvironmentFile=-/etc/catcrafts/payments.env