v0.7.0

fix(anda_x402_canister)!: refuse replayed payments and harden settlement

- /verify and /settle refuse an authorization that already settled. For the
  payer's latest payment the error names its ledger transaction, so a resource
  server that lost the settle response can reconcile it.
- Guard every validate_* method like the admin method it vouches for, and read
  token metadata with a bounded wait, so no caller can have the canister call
  an arbitrary canister and block it from stopping.
- Replace the takeover-style in-flight map with a PayerGuard released on drop,
  which a trap also triggers. This closes the race where a failed request
  cleared the reservation of a concurrent one after its funds had moved.
- Accept any authorization that has not expired instead of requiring a minute
  of remaining lifetime, which failed every maxTimeoutSeconds of 60 or less.
- Pull the payment fee after /settle replies, so settling waits for one ledger
  call instead of two.
- Copy only the asset fees per payment rather than the whole AssetInfo with its
  logo, list only the latest 100 log IDs in my_info, and expose the ledger
  transaction in payment logs.
- Only offer the implemented payment kind, debit fee withdrawals before the
  transfer, read request bodies by content-type, add the correctly named
  validate_admin_remove_supported_asset, and drop dead code along with the
  lazy_static, once_cell and num-traits dependencies.

BREAKING CHANGE: repeating a settled authorization on /settle now fails
instead of returning the original transaction.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>