fix(x402): sign payments with absolute expiry timestamp - #16

Summary

Fixes an x402 payment signing bug where validBefore was set to a timeout duration instead of an absolute Unix timestamp.

Problem

In the x402 flow, the CLI used maxTimeoutSeconds directly as validBefore in both:

• The EIP-712 typed message
• The serialized authorization payload

That produced values like 300 instead of now + 300, which can be immediately expired during facilitator verification.

Example:

• current time: 1700000000
• maxTimeoutSeconds: 300
• previous validBefore: 300
• correct validBefore: 1700000300

Changes

• Compute validBefore as current Unix time plus maxTimeoutSeconds.
• Reuse that same absolute value in both the signed typed data and outgoing authorization payload.
• Coerce maxTimeoutSeconds to int so both numeric and string challenge values work safely.

Tests

• Added deterministic regression tests for x402 payment header creation.
• Verifies validBefore is absolute in:
• typed_data.message.validBefore
• payload.authorization.validBefore
• Covers maxTimeoutSeconds as both int and string.
• Local results:
• targeted tests pass
• full suite passes: 69 passed

User Impact

• Prevents false expired-payment failures in x402 flows.
• Improves reliability for paid requests using x402 authentication.