feat(x402): add x402 payment rail (verify and settle)

[onyb]

Summary

Gates the paid Brave Search route behind a per-request x402 payment, verified and settled through a facilitator.

Try it

BRAVE_SEARCH_API_KEY=… \
X402_FACILITATOR_URL=https://facilitator.dummy/… \
cargo run

Cold request: no payment → 402 dual-rail challenge

$ curl -i 'http://127.0.0.1:8080/res/v1/web/search?q=rust'
HTTP/1.1 402 Payment Required
content-type: application/json
www-authenticate: Payment realm="bx402"

{
  "x402Version": 2,
  "error": "Payment required",
  "resource": {
    "url": "http://127.0.0.1:8080/res/v1/web/search",
    "description": "Brave Search API - Web / Search",
    "mimeType": "application/json"
  },
  "accepts": [{
    "scheme": "exact",
    "network": "eip155:84532",
    "amount": "5000",
    "asset": "0x036CbD53842c5426634e7929541eC2318f3dCF7e",
    "payTo": "0x0000000000000000000000000000000000000000",
    "maxTimeoutSeconds": 300,
    "extra": { "assetTransferMethod": "eip3009", "name": "USDC", "version": "2" }
  }]
}

Paid request: PAYMENT-SIGNATURE proof → 200 + settlement receipt

⚠️ Captured against a mock facilitator

$ curl -i -H 'payment-signature: <base64 payment payload>' \
       'http://127.0.0.1:8080/res/v1/web/search?q=rust'
HTTP/1.1 200 OK
content-type: application/json
payment-response: eyJuZXR3b3JrIjoiZWlwMTU1Ojg0NTMyIiwicGF5ZXIiOiIweDA5ZTBh…

{"web": {"results": [{"title": "Rust Programming Language", "url": "https://www.rust-lang.org"}]}}

The Payment-Response header is the base64 settlement receipt:

$ echo 'eyJuZXR3b3JrIjoi…' | base64 -d | jq
{
  "success": true,
  "network": "eip155:84532",
  "payer": "0x09e0a1b2c3d4e5f60718293a4b5c6d7e8f902c1f",
  "transaction": "0x4f2b8c1d9e3a07b6c5d4e3f201a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e39ad3"
}