Restrict wallet and payment APIs to approved B2B users

[leoxk]

What changed

• gate all wallet, redemption, and payment-session APIs on the user's current database group being b2b
• hide Wallet from non-B2B navigation and redirect direct /wallet access to 403
• update the Stripe minimum top-up acceptance test from US$20 to US$10

Why

The Wallet sidebar is a global display setting and is not an authorization boundary. Non-approved default users could still navigate directly to the wallet APIs and create payment sessions. The production B2B pilot must remain approval-only before live payment testing.

Safety

• the group is read from the database on every protected request, so downgrades take effect without waiting for session refresh
• Stripe webhooks remain public and signature-verified; only authenticated customer wallet routes are gated
• no pricing ratios, balances, existing users, channels, or payment credentials are changed

Validation

• default frontend typecheck passed
• default frontend production build passed
• git diff --check
• Go middleware and controller tests will run in CI (the local host does not have the Go toolchain)