Bump r402 from 0.13.0 to 0.14.0

[dependabot]

Bumps r402 from 0.13.0 to 0.14.0.

Changelog

Sourced from r402's changelog.

Changelog

All notable changes to the r402 workspace are documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

[Unreleased]

Settle pipeline hardening (SettlementMode unchanged)

• Three settlement modes kept: Sequential / Concurrent / Background (verify-then-settle timing as originally designed; Concurrent and Background still start settlement before or alongside the handler for stream/latency use).
• ResourceServer::settle_payment(..., overrides) — amount overrides (atomic / % / $) apply before settle hooks on the Sequential path.
• isValid: false runs on_verify_failure recovery (Go security semantics).
• SettleResponse success may use empty transaction (batch-settlement vouchers).
• batch-settlement: reject deposit on request path; EOA 65-byte voucher sigs only; atomic MemoryChannelStore::try_charge.
• auth-capture: reject settled txs with receipt.status() == false.
• MCP StillRequired carries corrective challenge + recovery_requested.

Transport parity fixes (SkipHandler body + Settlement-Overrides)

• SkipHandlerDirective body — HTTP Paygate (sequential / concurrent / background) and MCP PaymentWrapper now write the directive body / content_type (default application/json, body null when unset), matching foundation Go Gin middleware instead of returning an empty 200 / empty tool result.
• Settlement-Overrides — official HTTP header + amount formats (atomic, "50%", "$0.05") via r402_core::resolve_settlement_override_amount and r402_http::set_settlement_overrides. Sequential settle resolves and strips the header; UptoActualAmount remains as in-process atomic precedence. Concurrent rejects partial overrides (use Sequential); background strips the billing header and settles the signed max.

Resource server lifecycle (official X402ResourceServer V2 parity)

• ResourceServerHooks in r402-core — transport-agnostic server lifecycle: before_verify / after_verify / on_verify_failure, before_settle / after_settle / on_settle_failure, on_verified_payment_canceled (handler_threw | handler_failed | after_verify_aborted).
• BeforeOpDecision — Continue | Abort | Skip { result } (local short-circuit, for batch-settlement vouchers later).
• AfterVerifyDecision — Continue | Abort | SkipHandler (inline settle without resource handler).
• VerifyPaymentOutcome — verify path returns response + optional skip_handler directive.
• CancellationGuard — fires cancel hooks at most once per payment.

... (truncated)

Commits

• 255cad7 ci: include r402-tron and r402-casper in crates.io publish list
• ed0df34 Merge pull request #50 from qntx/fix/casper-preflight-hardening
• cef9e61 docs: complete multi-chain README coverage (evm/svm/tron/casper)
• 7976316 chore: ignore local docs/ directory
• cac2a42 style(casper): rustfmt import and module order
• c8a71b1 fix(casper): silence unused_crate_dependencies for client deps
• 6b27997 fix(docs): resolve casper and tron rustdoc link warnings
• a0eb91e fix(casper): harden preflight, add SchemeClient, surface tron docs
• 741d2a3 Merge pull request #43 from mssteuer/feat/casper-chain-crate
• 73321dc style(casper): satisfy workspace clippy gate
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)