fix(orders): enforce configured expiry

Apply the configured order lifetime to all checkout flows and close unpaid orders once their expiry is reached.

src/Settings/PaymentRuntime.php

@@ -392,6 +392,20 @@ class PaymentRuntime {
         ];
     }
 
+    /**
+     * Return the UTC expiry time for a newly created payable order.
+     *
+     * Keeping this in the payment runtime prevents individual checkout
+     * flows from drifting away from the admin "payment_order_expiry" setting.
+     */
+    public static function get_order_expiry_at(?int $now = null): string {
+        $settings = self::get_order_settings();
+        $timestamp = $now ?? time();
+        $minutes = max(5, min(1440, (int) ($settings['expiry'] ?? 30)));
+
+        return gmdate('Y-m-d H:i:s', $timestamp + $minutes * MINUTE_IN_SECONDS);
+    }
+
     /**
      * @return array<string,mixed>
      */