customerpayment: cross-tenant GET/PATCH/DELETE returns 403 — same class as #221 (secure-404)

[CryptoJones]

Same class as the 10 prior secure-404 fixes (#173–#221), now on customer-cascade-scoped CustomerPayment (cpayCustId → Customer.custCompId). Collapse 403 into 404 to close enumeration of cpayId populations.

Proudly Made in Nebraska. Go Big Red! 🌽 https://xkcd.com/2347/