Send each scheduled payment's due notice exactly once

The daily billing scan runs on request via WP-Cron and can overlap
itself under concurrent traffic. Each run emailed the payments it
created with no record that a notice had gone out, so two overlapping
runs could send a payer two identical "Payment due" emails for one
charge — read by families as being billed twice, though only one row
exists.

Stamp us_payments.notice_sent_at atomically before emailing: the scan
now claims each payment with a conditional UPDATE ... WHERE
notice_sent_at IS NULL and only notices, credits and batches the rows
it won. A competing run finds them claimed and stays quiet, so exactly
one notice is sent regardless of how the scan is triggered. A one-time
backfill stamps existing scheduled rows on upgrade so already-noticed
charges are not re-emailed.

Co-authored-by: anthropic/claude-opus-4-8

tests/Unit/Payment/PaymentTest.php

@@ -45,6 +45,7 @@ class PaymentTest extends TestCase
             'stripe_payment_intent_id' => null,
             'receipt_number'           => 'USC-7',
             'receipt_sent_at'          => null,
+            'notice_sent_at'           => '2026-06-07 08:00:00',
             'paid_at'                  => '2026-06-08 10:00:00',
             'created_at'               => '2026-06-08 09:00:00',
         ]);
@@ -56,6 +57,7 @@ class PaymentTest extends TestCase
         self::assertSame(Payment::METHOD_COMP, $payment->method);
         self::assertTrue($payment->isPaid());
         self::assertSame('USC-7', $payment->receiptNumber);
+        self::assertSame('2026-06-07 08:00:00', $payment->noticeSentAt);
         self::assertSame('2026-06-08 09:00:00', $payment->createdAt);
     }