Adds listTransactions controller action and its Swig view, and creates
app/routes/admin.server.routes.js to finally wire every admin controller
function (Tasks 7-9) to real HTTP routes via the app's glob-based route
loader. basicAuth protects /admin/transactions and /admin/transactions/new;
the pay page, epay return, and epay IPN endpoints stay public.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Implements Task 7: newTransactionForm and createTransaction controller functions with supporting view.
- Controller generates merTrxId and transCode with UUID-based unique suffix
- Signs transaction using epaySign.signRequest
- Persists AdminTransaction record to MongoDB
- Returns JSON response with code 00/99 and payment URL
- View provides HTML form to submit customer data and display payment link
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Implements signRequest and signResponse functions that compute
MegaPay/Epay HMAC-SHA256 signatures per MGP_Merchant_Interface
specification sections 5.1 and 5.3. These functions will be consumed
by Tasks 7 and 9 of the admin transaction management feature.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Add mongoUri and admin.{user,password} config keys to config/env/all.js
for Task 2 admin transaction management feature. Follows existing env var
pattern used for payment provider credentials. Default mongoUri points to
Docker service; admin credentials read from ADMIN_USER/ADMIN_PASSWORD env.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

11 bite-sized tasks: Docker Compose mongo service, config, Mongoose
connection, shared MegaPay signing helper, model, Basic Auth middleware,
create/pay/return/ipn/history endpoints, final Docker integration test.

New self-contained module for staff to create Epay payment links for
customers and track their status, kept separate from the just-stabilized
/epay/* customer-facing flow to avoid regression risk.