Guard escrow webhook state transitions

[phucnguyen1707]

Summary

• Guard escrow webhook status updates with allowed current states so stale events cannot overwrite closed escrow states
• Keep funded, released, and refunded transitions idempotent before application updates or notifications run
• Add webhook tests for the pending funded flow and stale funded/refunded events on released escrows

Tests

• pnpm test:run src/app/api/payments/coinpayportal/webhook/route.test.ts
• pnpm exec eslint src/app/api/payments/coinpayportal/webhook/route.ts src/app/api/payments/coinpayportal/webhook/route.test.ts
• pnpm type-check
• pre-commit hook: lint, type-check, full test suite, production build