feat(payments): add CEP-8 authorization store

[harsh04044]

Part of #100

The next piece of CEP-8 explicit gating: the store that tracks which payments are in flight and which have been paid, keyed by the canonical identity from #103. Still pure. No middleware or transport yet, that comes in a later PR.

It's a separate PR because of the concurrency. ts-sdk gets away with a plain map since Node is single-threaded and its claim/trySetPending never await mid-operation, so nothing interleaves. We're on multi-threaded tokio, where two requests can hit claim on the same grant at the same time on two cores. So the store sits behind one std::sync::Mutex and each op does its whole check-and-mutate in a single critical section with no await inside. That's what stops one grant being claimed twice.

std::sync::Mutex on purpose, not tokio's: the sections never await, so an async lock adds nothing, and the std guard won't let an await creep in later either (it isn't Send, so it won't compile inside tokio::spawn and clippy catches it). Grants and pending are two separate LruCaches so they evict independently, 5000 each, with lazy Instant TTLs.

Tests are the 9 from the ts-sdk's own suite ported over, plus a couple that throw a bunch of tasks at a single grant and check exactly one wins.