docs: agent flow end to end — answers the six-point audit

[enot3615]

One document covering the agent-flow audit's six questions, each against what the code does today:

1. agent vs mcp — two products, install separately; mcp depends on agent, not the reverse
2. discovery from a bare domain — the 402 teaches on contact; aifpDiscovery at the root serves /.well-known/x402.json (with the Next.js note)
3. init — prints addresses, never the key; ephemeral runs say so loudly
4. at-rest — plaintext by default, AIFINPAY_WALLET_PASSPHRASE encrypts (rc.4); one seed → all chains, no per-chain seed
5. double-pay — orderIdHash + nonce + consumedNonce, checked before broadcast
6. what it buys — describeQuote states amount, fee rate, and scope in words

References #55 (encryption) and #56 (describeQuote).