fix(x402): use CDP JWT authentication

[pulkit136]

Summary

Updates the x402 service's Coinbase CDP facilitator authentication from the previous static Bearer credential format to short-lived ES256 JWT authentication.

Changes

• Replace Bearer ${apiKeyId}:${apiKeySecret} authentication with CDP-compatible ES256 JWTs.
• Generate a fresh JWT for every /verify and /settle request.
• Include request-specific uri claims for the facilitator endpoint.
• Include kid and a fresh cryptographic nonce in the JWT header.
• Add iss, sub, nbf, and exp claims.
• Use Node's built-in node:crypto, with no new dependencies.
• Update facilitator tests to validate JWT structure, claims, nonce generation, and the actual ES256 signature.
• Update payment test fixtures to use a generated P-256 test key.
• Document the expected EC private-key PEM format for X402_CDP_API_KEY_SECRET.

Validation

• 56/56 x402-service tests passing.
• 119/119 workspace tests passing.
• npm run typecheck passes with 0 errors.
• git diff --check passes.
• JWT signatures are cryptographically verified in tests using the generated public key.
• /verify and /settle are tested with separate request-specific URI claims.
• No external dependencies were added.

Scope

This PR is limited to Coinbase CDP facilitator authentication in x402-service.

No changes were made to:

• payment state transitions
• SQLite/CAS logic
• HTTP routing
• live-mode safety guards
• agents-gateway
• other packages

This addresses a pre-production authentication/integration blocker. Live authentication against Coinbase CDP has not been performed as part of this PR.