fix(tap-seller): canonicalize signature parameters

[nkavian]

Summary

• Parse TAP signature parameters in signer-selected order, with Structured Field escaping and canonical serialization.
• Apply the last value of duplicate parameters consistently to time validation, key resolution, replay claims and signature verification. Duplicate covered components remain invalid.
• Require actual Ed25519 key material, including when the application supplies a custom resolver.
• Exercise the public verifier, middleware, replay store and HTTP key resolver through the shared TAP corpus.

Verification

• Full pnpm verify on Node 22 and 24.
• pnpm check-exports and pnpm verify-publish.
• All shared runtime, MPP, x402 and TAP cases on both Node versions, including 92 TAP cases.
• Public-path regressions cover canonical duplicates, tampering, escaped values, malformed parameters, handler suppression and mislabeled RSA keys.

Merge order

Depends on inflowpayai/inflow-specs#25. Merge the specs PR first, then rerun this PR's shared-conformance workflow: its current-contract TAP check requires that corpus on specs main.

The contract pin also requires declaring the SDK's existing MPP Seller subscription capability; no MPP payment behavior changes here. SPT, CARD, instrument work and PR 85 are outside this PR. No live payments were performed.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!