Funding modality

Part of #591. Membership is carried by the Funding label and by this issue's sub-issues.

Absorbs the requirement previously stated as REQ3.

The problem

PaymentTopUpSource assumes the product already holds the money. A user who hits
InsufficientBalance has reached a dead end: nothing in the protocol moves value from the
outside world into their CASH balance, so the product can only report the failure and stop.
In the other direction there is no path at all — value cannot leave.

There is also no declared contract for who can move that value, so every provider
integration lands as bespoke host code rather than as a product declaring what it serves.

What has to be true

• Value moves into a balance from outside, and out of it.
• A provider declares the modality it serves in its manifest and receives intents addressed
  to it; a consumer declares an intent and watches it to completion.
• The rails a surface supports are declared, not inferred.