fix: process refunds with CEI ordering

[sirakinb]

Summary

• persist Processed status and clear the pending-refund marker before the token transfer
• keep the balance/deadline checks before state changes
• add a replay regression test proving a processed refund cannot be paid again

Tests

• cargo fmt -p pulsar-refund-processor --check
• cargo +1.91.1 test -p pulsar-refund-processor

Refs #552