v4.6.2 - Security release: policy key only signs server-built transactions

Security release. Every site running 4.6.1 or earlier should update. No schema changes; drop-in replacement.

Security

• The policy key only co-signs transactions this site built. Previously the mint submit paths (checkout, REST /mint/submit, /upgrade/submit) signed whatever transaction a visitor posted. Every build is now recorded server-side by transaction id and can be submitted once, within 30 minutes; anything else is refused. Supply, per-wallet counts, alt-pay invoices and discount commits come from that record, not from the request.
• Merchant payout address always comes from Plugin Setup, never from the browser.
• Asset-upgrade re-mint requires this site's burn of the same asset, from the same wallet, to be confirmed on-chain; one re-mint per burn. The upgrade modal waits for the burn and can resume an interrupted re-mint.
• Alt-pay invoices are bound to their mint, cover one asset, and are consumed atomically, so one payment backs one mint.
• Discount codes are always committed, so single-use codes stay single-use.
• Timeouts or server errors during submit no longer hand single-use state back (the tx may have gone through); only a definite rejection does.

Fixed

• Image URLs and royalty addresses over 64 bytes (e.g. CIDv1 IPFS links) are chunked per CIP-25 / CIP-27, so they no longer fail the build.
• The BTC / ETH / SOL wallet tabs load on PHP 7.4 again.
• The embeddable widget can submit mints again.

Full details in CHANGELOG.md.