authorize/decline event constants are swapped — breaks the public HTTP contract while internal tests stay green

POST /v1/payments/{id}/events/authorize -- the literal, documented API endpoint every real integration (a merchant's backend, a support tool, a curl command in this very README) calls to authorize a payment -- currently declines it instead. And the reverse: calling .../events/decline authorizes it. This is about as bad as a payment API bug gets: it's not a crash, not a 500, not even an obviously wrong response -- the request succeeds, returns 200, and does the opposite of what was asked. A merchant integration built and tested against this API would ship completely broken, while every one of this project's own Go-level tests keeps passing, because they all refer to payment.EventAuthorize/EventDecline by their symbolic Go names rather than by the literal string a real HTTP client sends.

internal/payment/models.go declares EventAuthorize = "decline" and EventDecline = "authorize". Every internal call site (the transition table in machine.go, the outbox dispatcher's resolve) consistently uses the symbolic names payment.EventAuthorize / payment.EventDecline, so internal Go code is self-consistent and its own tests don't notice anything is wrong. But the HTTP handler for POST /v1/payments/{id}/events/{event} takes {event} as a raw path parameter -- a literal string -- and fires it directly against the machine. The literal string "authorize" in the URL now maps (via the swapped constants) to the transition originally meant for "decline".

ID=$(curl -s -X POST localhost:8080/v1/payments -d '{"amount_minor":1000,"currency":"INR"}' | jq -r .id) curl -s -X POST localhost:8080/v1/payments/$ID/events/authorize curl -s localhost:8080/v1/payments/$ID | jq .state

-> "failed", not "authorized"

This is a real lesson about string constants that are also part of a public, external contract (an HTTP path segment, in this case): as long as every reference goes through the symbolic Go constant, swapping the constants' underlying values is invisible to Go-level tests. Only a test that exercises the actual wire format -- the literal strings a real caller sends -- can catch this class of bug. This is exactly why tickets/tests/ticket12_test.go posts to a literal URL path instead of calling payment.EventAuthorize from Go.

Look at the two constant declarations in internal/payment/models.go and check each one's string literal against its own name and the comment right next to it.