x402 Binding Audit

Check that every challenge you captured names the endpoint that served it. A challenge naming a different resource would, if paid, satisfy a requirement for something else. A host mismatch is reported differently from a path mismatch, the first being the stronger signal. Also reports a non-https resource and, under version 2, a bare string resource, where a client reading resource.url gets undefined and stops checking the binding. Nothing is fetched and nothing is paid.