test: verify public payment security boundaries

[nkavian]

Summary

• Exercise MPP Buyer/Seller and x402 Buyer/Facilitator public calls against real local HTTP servers for redirects, dropped responses, cancellation, and retry behavior.
• Verify credential and cookie isolation, environment selection, account-role errors, bearer authentication, and redacted diagnostics.
• Confirm MPP broadcast retries preserve their body and idempotency key; uncertain payment creation and x402 settlement are not replayed.

This is test-only. The review against Node and server source found no necessary runtime or contract changes.

Verification

• make sync and make verify passed on Python 3.11–3.14: 817 tests, formatting, strict typing, coverage gates, builds, and isolated package consumers.
• Final repeat passed code checks and tests; its consumer download hit a network failure. Retrying make consumer-smoke passed.
• git diff --check passed.

Local HTTP tests do not execute server authorization or move funds. Live sandbox certification and cross-language interoperability remain separate queued tasks.