Align portal payments with endpoint permissions

The portal Pay button shows only where the checkout endpoint allows it, so drafts, cancelled documents and staff users no longer see it.