Harden dual payment middleware

[mmurrs]

Summary

• Pin mppx to the audit-clean Node 22 compatible production path
• Fail fast on malformed facilitator URLs and header-unsafe descriptions
• Add local accepted payment requirement checks before facilitator calls
• Add minimal CI for install, check, and production audit

Validation

• npm run check
• npm audit --omit=dev