feat(website_sale): capture optional Monero refund address at checkout (#4)

[bnuckols13]

Closes #4.

The issue asks to let a shopper provide a refund address for when they overpay or an item is out of stock. This adds an optional, validated Monero refund address to the checkout flow, captured on the order and shown to the merchant. It does not send refunds — capturing the address is what the issue asks for, and auto-refunding would touch wallet-spend code that is out of scope here.

What changed

• sale.order.monero_refund_address (models/sales_order.py): a Char field with an @api.constrains that validates the value with the already-required monero package (monero.address.address()), raising a clear ValidationError on a malformed address. An empty value is allowed, so checkout is unaffected when the shopper skips it. Validating on the model means every write path — web, backend, API — is covered.
• Capture at the payment step (controllers/website_sale.py): a small POST /shop/monero/refund_address route writes the address onto the cart order; an invalid entry is reported back on the payment page (via a ?monero_refund_error=1 redirect flag) instead of crashing checkout. The input is rendered only when Monero is an available provider.
• Payment-page input + merchant view (views/monero_refund_address_views.xml): an optional "Refund address (Monero)" input inherited into website_sale.payment, and the field surfaced on the backend sale.order form so the merchant can see where to refund.
• Tests (tests/test_refund_address.py): valid address stored; invalid rejected on create and on write; empty allowed; surrounding whitespace tolerated.

One extra change, called out for transparency

While adding tests I found a pre-existing test that errors on Odoo 19: tests/test_controllers.py::test_rpc_unauthorized_raises_validation_error assigned a MagicMock directly onto a payment.provider record's get_wallet method, which Odoo 19 rejects as read-only (AttributeError: ... is read-only). I fixed it to mock a provider object the way the sibling test already does. It sits in the same controller this PR touches and makes the suite green. Happy to split it into its own PR if you'd prefer.

Verification

• Full module test suite green on Odoo 19: 0 failed, 0 errors of 19 tests (was 13/14 before, with that one pre-existing error).
• End-to-end on a running Odoo 19 instance: the input renders on the payment page, an invalid address is rejected without breaking checkout, and a valid address persists on the order and shows on the backend form.

Out of scope (deliberately)

No automatic refund sending, no change to payment detection/confirmation, no new dependencies.

Known minor

The server validates a trimmed value, and the checkout route trims before storing, so addresses captured from the storefront are clean. A refund address typed directly into the backend order form is stored as entered (surrounding whitespace kept). Happy to normalize on write if you'd like the field trimmed on every path.