feat: hardware-verifiable x402 payments

[BitHighlander]

Summary:

• validate official Solana exact PaymentRequirements before passing payment metadata to firmware
• route zero-LUT v0 transactions through SolanaSignTx instead of the blind message-signing fallback
• recognize official EIP-3009 exact-payment typed data on EVM
• document the REST x402 request and pin canonical device-protocol and hdwallet staging merge SHAs

Validated locally:

• 15 focused EVM/Solana x402 and signing-route tests pass
• production Vault bundle succeeds against the exact canonical submodule pins

Release gate:

• depends on the fork firmware PR and real KeepKey hardware validation
• keep this draft until the firmware artifact passes on-device