Add XGuard Hosted Gate for Nginx, Caddy and Traefik payment enforcement

[moelayyan90]

Add a central x402 v2 payment authorization endpoint that existing reverse proxies can call before reaching an application.

GET|POST /v1/gate/authorize:

• returns the standard x402 v2 402 + PAYMENT-REQUIRED challenge when no payment is present
• accepts PAYMENT-SIGNATURE and strictly binds the payload to configured scheme/network/asset/payTo/amount/resource before any facilitator call
• calls XGuard /verify, then /settle; the origin is authorized only after successful settlement
• returns PAYMENT-RESPONSE, receipt and route metadata on successful authorization
• ambiguous settlement outcomes remain fail-closed with 503
• only the dedicated X-XGuard-Key is forwarded for Usage Credits; arbitrary backend Authorization headers are not repurposed
• supports explicit resource URLs or trusted X-Forwarded-Proto/Host/Uri
• current hosted scope intentionally starts with exact Base-mainnet USDC, rejecting unsupported payment kinds instead of guessing
• includes Nginx auth_request compatibility (401 subrequest carrying PAYMENT-REQUIRED, mapped back to public 402)
• includes Caddy/Traefik/Nginx deployment guidance
• uses a small production entry wrapper so existing facilitator/routing code remains untouched outside /v1/gate*

The intended adopted topology is:
client -> existing reverse proxy -> XGuard Hosted Gate -> verify/settle -> origin

Behavioral tests cover challenge generation, forward-auth resource derivation, nginx mode, signed-policy mismatch, verify-before-settle, successful PAYMENT-RESPONSE and ambiguous-settlement fail-closed behavior.