payment should receive purchase, not capture if payment is auto_capture'd

Capture requires a prior authorization, whereas purchase does authorization+capture in one go
Make considered_risky a database field, rather than a state

This is because if an order completes the checkout and is 'considered risky', then the checkout will attempt to render a partial for this state. We do not want users to be seeing any kind of indication that their order is considered risky. It should go through as per normal.

The only way to do this is to take the risk consideration out of the state machine and move it into a database field