feat: add HMAC-SHA256 challenge ID generation

[brendanjryan]

Add support for HMAC-bound challenge IDs matching the TypeScript SDK.

Changes

• Add generate_challenge_id() function for HMAC-SHA256 ID computation
• Add Challenge.create() factory method with secret_key parameter
• Add Challenge.verify() method for stateless challenge verification
• Add optional secret_key parameter to verify_or_challenge() and @requires_payment decorator
• Add cross-SDK compatibility tests using conformance test vectors from mpay-sdks

API

Challenge.create()

challenge = Challenge.create(
    secret_key="my-server-secret",
    realm="api.example.com",
    method="tempo",
    intent="charge",
    request={"amount": "1000000", "currency": "0x...", "recipient": "0x..."},
)

Challenge.verify()

is_valid = challenge.verify(secret_key="my-server-secret", realm="api.example.com")

verify_or_challenge() with secret_key

result = await verify_or_challenge(
    authorization=request.headers.get("Authorization"),
    intent=intent,
    request={...},
    realm="api.example.com",
    secret_key="my-server-secret",  # Enables HMAC-bound IDs
)

Algorithm

HMAC input format: realm|method|intent|request_b64|expires|digest (pipe-delimited)
Output: base64url(HMAC-SHA256(secret_key, input))

When secret_key is omitted, falls back to random IDs (secrets.token_urlsafe(16)).

Cross-SDK Compatibility

All 8 conformance test cases pass, matching TypeScript and Rust SDK outputs.

Related: tempoxyz/mpp-rs#23