Remove failed-payment course access to protect revenue before billing

Your failed payment events leave students with continued course access and cause revenue leakage and extra support work. This flags accounts, notifies billing, and revokes access so revenue is secured before the next billing run.