fix: preflight x402 inputs before settlement

[cursor]

Bug and impact

• Anonymous x402 payments were settled before route-level input validation, so callers could be charged for requests that handlers immediately rejected (for example, missing text or an unsupported algorithm on /v1/tools/generate-hash).
• The Render deploy workflow also hid failed API tests and failed deploy trigger calls, allowing a green workflow even when tests failed or no deploy was triggered.

Fix

• Added an x402 preflight that validates cheap deterministic request shape (required fields/enums, plus known aliases/overrides) before nonce reservation, verification, or settlement.
• Made the deploy workflow run npm test from api/ and fail if tests or the Render trigger fail.
• Added hardening coverage for both behaviors and included that suite in npm test.

Validation

• npm run build && node tests/tools-credits-hardening.test.mjs && node tests/x402-v1-passthrough.test.mjs && node tests/x402-sell-copy.test.mjs
• npm run build && npm test