fix: client robustness improvements

[brendanjryan]

Summary

Ports valuable non-breaking improvements from the closed PR #7.

Changes

Multiple WWW-Authenticate header handling (RFC 9110)

• Servers may return multiple WWW-Authenticate headers with different auth schemes
• Client now iterates through all headers to find a matching Payment challenge
• Correctly handles mixed auth schemes (e.g., Bearer + Payment)

Client-side expiry check

• If challenge has expires and it's already passed, skip payment attempt
• UX guardrail to fail fast rather than wasting a transaction
• Logs warning when challenge is expired

MCP decorator refactor

• Removed duplicated verification logic from @requires_payment decorator
• Now uses shared verify_or_challenge() function
• Preserves actual verification error messages in responses

Testing

• Added test_skips_expired_challenge - verifies client doesn't pay expired challenges
• Added test_handles_multiple_www_authenticate_headers - verifies multi-header parsing
• All 123 tests pass