[Feature/Roadmap] Implement AP2 mandate verification (Agent Payments Protocol)

[SergeevDmitry]

Context & Rationale

The gateway can prove that a payment settled, but it cannot prove that a user
authorized an agent to make the specific purchase. AP2
addresses that gap with verifiable mandates that bind user intent, checkout and
payment authorization.

AP2 is an authorization layer rather than a replacement for the gateway's
protocol adapters or payment rails. The gateway should verify mandates on the
merchant side and preserve the result in its audit trail.

Proposed Changes

• Accept AP2 mandate data alongside supported payment submissions for resources
  whose merchant policy requires it.
• Verify mandate authenticity, validity, trusted issuer and replay/context
  binding before settlement and delivery.
• Require the authorized resource, amount and other relevant purchase details
  to match the gateway's resolved request.
• Add merchant configuration for AP2 trust policy and fail closed when a
  required mandate is missing or invalid.
• Record the verified mandate reference on the commerce receipt and expose a
  distinct authorization error when verification fails.
• Add positive and adversarial tests covering valid, altered, expired,
  mismatched, untrusted and replayed mandates.

Non-goals / Invariants Preserved

• The gateway does not issue mandates or hold user, agent or merchant signing
  keys.
• A mandate never replaces payment and cannot unlock a paid resource by itself.
• Disputes, chargebacks and refunds remain outside this implementation.
• Verification infrastructure failures are reported as service unavailability,
  not as buyer payment failures.

Impact & Value

• Adds verifiable proof that an agent purchase matched the authority granted by
  the user.
• Improves merchant auditability and provides stronger evidence for later
  review or dispute handling.
• Extends the existing non-custodial payment flow without introducing another
  settlement path.