research: test nested approve authorization for upto - #240

Closes #62

Summary

Resolves #62 by experimentally testing whether a single Soroban authorization entry can cover an authorize call containing a nested SEP-41 token.approve sub-invocation.

What Was Tested

• Construction of a nested Soroban authorization tree.
• Signing and execution using a single payer authorization entry.
• Resulting authorization-tree structure.
• What the payer's signature commits to.
• Token approval state after execution.
• Nested versus separate invocation budget costs.
• @x402/stellar validateAuthEntries behavior.
• Wallet presentation where the environment allowed it.

Findings

The spike documents whether Soroban technically permits the construction separately from whether the current x402 Stellar facilitator/ecosystem considers the authorization acceptable.

ADR-002 §6.2 has been updated with the resulting evidence and recommendation.

Scope

This is an isolated research spike.

No production upto implementation or production contract authorization behavior was changed.

Validation

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace
• Dedicated nested-authorization spike tests

Evidence

The PR includes the reproducible experiment, authorization-tree analysis, budget comparison, and validateAuthEntries findings.