Make XGuard Reconcile bare path expose a safe monitorable 402 challenge

[moelayyan90]

Fix the concrete rejection feedback from x402-list without weakening payment safety.

Previously a bare GET /v1/reconcile returned 400 invalid_input before the x402 middleware, so directory monitors could not detect the service as an x402 paid resource.

This change adds a thin discovery entry:

• bare unsigned probe returns standard x402 v2 402 + PAYMENT-REQUIRED
• challenge advertises the existing real Base-mainnet USDC treasury, amount 2000 atomic = $0.002, and an example resource URL containing valid-shaped from + nonce
• a signed retry against the bare URL is rejected with 400 before the paid application is invoked, so crawler friendliness cannot charge a client for dummy/example input
• real calls that include input continue to the existing x402 Reconcile application unchanged
• missing/invalid treasury fails closed with 503
• tests verify the 402 challenge, real treasury/amount metadata, signed-bare rejection and missing-treasury fail-closed behavior

This directly addresses x402-list's rejection: their monitor probes the plain path and expected the 402 challenge there.