x402 protocol v2, network/facilitator abstraction, and real Base Sepolia settlement

[SergeevDmitry]

• x402 v1 → v2. @x402/core + @x402/evm 2.23.0, CAIP-2 networks,
  PAYMENT-SIGNATURE / PAYMENT-RESPONSE / PAYMENT-REQUIRED headers. No v1
  fallback. Drops 437 transitive packages.
• Three environments, one config. local | testnet | mainnet is derived
  from the network and the facilitator — chain id 84532 belongs to both the
  local chain and Base Sepolia, so the id alone can't say which.
• Remote facilitators, behind the SDK's own FacilitatorClient. With one
  configured the gateway holds no signing key at all.
• Mainnet guardrails refused at config load: missing allowMainnet, local
  facilitator, unauthenticated facilitator, non-HTTPS URL, dev payTo,
  non-canonical asset.
• Real Base Sepolia settlement, verified on chain —
  0xf3288399…,
  0.01 USDC, gas paid by the facilitator. New npm run test:testnet suite and a
  manual-only CI workflow, both kept out of the offline test paths.
• Fixed an upstream misattribution: the v2 scheme reports an unreachable RPC
  as an invalid signature, blaming the buyer for an outage. Now
  PAYMENT_PROVIDER_UNAVAILABLE.
• Behaviour change: a post-settlement replay now surfaces as
  PAYMENT_INVALID, not PAYMENT_REPLAYED. Fail-closed unchanged; the
  pre-settlement replayKey reservation still covers the concurrent case.
• Not claimed: mainnet. Configurable and guarded, nothing settled on it.

[Revinand]

Approved