fix: auto-cleanup stale payment orders and expired pending bindings

- closeStaleOrders: marks payment orders older than 24h as 'closed'
- closeExpiredPending: marks expired binding requests (bind_status=3) as cancelled
- Both run on app startup (SCF cold start), no cron needed
- countPendingByUser already filters to 2h window (previous commit)

server/src/app.js

@@ -80,4 +80,12 @@ app.use((err, req, res, _next) => {
   res.status(500).json(fail(3001, 'server_error'))
 })
 
+// Clean up stale records on startup (SCF cold start)
+require('./dao/payment-order.dao').closeStaleOrders().catch(err => {
+  console.error('[STARTUP] closeStaleOrders failed:', err.message)
+})
+require('./dao/binding.dao').closeExpiredPending().catch(err => {
+  console.error('[STARTUP] closeExpiredPending failed:', err.message)
+})
+
 module.exports = app