fix(x402): stop prefix bypass in service allowlist matching

[SashaMIT]

Description

isServiceRegistered / is_service_registered previously treated a service as allowed when url.startsWith(registered). That enables classic prefix bypasses, for example registering https://api.example.com and later requesting https://api.example.com.evil.com/....

This changes matching to:

• bare origin registration → any path on that origin
• full registered URL → same origin and exact path or segment-boundary path prefix

TypeScript and Python providers are updated together. Adds unit tests for the bypass cases.

AI disclosure

Drafted with AI assistance; reviewed against the allowlist bypass class (hostname-suffix / unsafe prefix matching).

Test plan

• Unit tests for hostname-suffix rejection and valid origin/path cases
• CI on this PR
• Confirm existing registered-origin configs still allow intended paths

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 0 Sum 1

[SashaMIT]

Friendly bump — these three tips harden agent spend paths (allowlist matching, Jupiter slippage cap, Permit2 amount + EIP-712 bind). Happy to adjust naming/tests if anything conflicts with your roadmap. Tips are SSH-signed under SashaMIT.