fix: expose x402 browser payment headers

[peterxing]

Summary

• make the x402 adapter CORS contract explicit for browser agents instead of relying on wildcard request headers
• allow x-payment, x-payment-proof, and x-payment-signature in preflight responses
• expose the x402/payment response headers clients need to read the 402 challenge and settled receipt
• add /pay/x402 and /x402/discovery JSON endpoints so discovery/docs links have a lightweight browser-readable target
• emit payment-required alongside the existing x-payment-required challenge header for generic x402 clients

Fixes #18.

Verification

• node --check adapters\\x402\\server.js
• git diff --check
• local HTTP smoke on port 18412:
  • GET /pay/x402 => 200 with payment request/response header lists
  • GET /x402/discovery => 200
  • OPTIONS /x402/hash.sha256 with x-payment-proof, x-payment-signature, x-payment, content-type => 204 and explicit allowed headers

No payment headers, signatures, wallet material, or paid calls were sent during verification.