Take x402 2.23.0 and the minor-patch group, cut 2.9.1

[vvillait88]

Summary

Dependency sweep. @x402/core, @x402/evm and @x402/extensions move 2.20.0 to
2.23.0 as a set, plus @solana/kit 7.1.1, fastify 5.12.1, hono 4.13.3, and
vitest / @vitest/coverage-v8 4.1.11.

Every one of these is a devDependency here. The peerDependencies ranges are
deliberately untouched and stay permissive (hono >=4.0.0, fastify >=4.0.0,
@solana/kit >=7.0.0 <8.0.0), so nothing in this diff reaches a consumer.

Worth recording because it is not obvious: x402 2.23.0 turns client-side spend
controls ON by default. A fresh x402Client carries spendControls = {} rather
than false, and an omitted maxAmountPerPayment falls back to
DEFAULT_MAX_AMOUNT_PER_PAYMENT ("$1"). That is a payer-side change and this
package is the merchant side: it constructs no x402Client anywhere in src, so
the default cannot reach it. The agent-side handling lives in pay.

Version bumped to 2.9.1 for a coordinated release across the SDKs, commerce
libraries and pay, rather than because this change requires callers to act.

Worked with: Varun.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

None. No exported type, function signature, wire format or response shape
changes, and no peer range moved. The only non-lockfile edits are devDependency
versions and the version field.

The x402 upgrade was scoped before taking it rather than trusted on the version
number, since it sits on a wire contract:

• @x402/core exported surface 2.20.0 to 2.23.0: zero removals, 8 additions
• @x402/evm (the signing path): zero removals, 9 additions
• @x402/fetch type surface: byte-identical
• Protocol-governed field counts (maxAmountRequired, x402Version, decimals)
  increase only, which is the additive signature
• Live 402 challenges from two storefronts still carry extra keys
  ["name", "version"] and no paymentFlow

Test plan

Ran the repo's full gate set locally on this branch:

• bun run typecheck clean, including examples/tsconfig.json
• bun run lint clean (eslint, max-warnings 0)
• bun run test: 119 files passed, 1 skipped; 1817 tests passed, 4 skipped
• osv-scanner over bun.lock: no issues found across 948 packages

No tests were added or changed, because no behavior changed in this package.

Checklist

• Tests cover the new behavior, and the suite passes locally
  (no new behavior here; the existing suite passes unchanged on x402 2.23.0)
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed
  (public surface did not change, so nothing to update)
• No secrets, credentials, or personal data in the diff or the tests

Deliberately not done

• The @agent-score/sdk floor stays ^2.7.4 rather than moving to the freshly
  published ^2.7.6. Nothing in this diff needs 2.7.6, and tightening a floor on
  a public package forces an upgrade on external consumers for no reason. The
  existing range already accepts it.
• No tag pushed. The publish workflow fires on v* and an npm version is
  permanent, so the tag is a deliberate step after this merges.