Lint an x402 endpoint

Paste a URL that returns 402 Payment Required. We read its payment terms server-side and flag the traps that fool a naive buyer — no install, nothing signed.

To grade a buyer client (does it pin the payee, cap the price?), run npx @deepfirstsearch/x402-scan client @x402/fetch.