Umbrella: Add optional on-chain USDC settlement verification

[AnkanMisra]

Summary

Umbrella issue for optional on-chain USDC settlement verification. The implementation work is split into smaller child issues so the project can separate configuration, settlement verification, and replay protection concerns cleanly.

Current State

The current project validates signed payment authorization only. It does not yet verify on-chain USDC settlement, and it does not yet define replay semantics for transaction reuse.

Child Issues

• Add explicit payment mode config for signature authorization vs settlement #229 — explicit payment-mode configuration and docs
• Verify on-chain USDC transfer details before granting paid access #232 — on-chain USDC transfer verification path
• Prevent replay of verified on-chain settlement transactions #231 — replay prevention or bounded transaction reuse

Acceptance Criteria

This umbrella issue is complete when the child issues land and the resulting docs, tests, and public contract clearly distinguish signature authorization from real settlement.

Non-goals

• Do not assign this umbrella issue directly as one contributor task.
• Do not blur signature-only authorization with on-chain settlement.

[peterxing]

This issue is the right place to draw a hard line between "signature authorization" and "USDC actually settled".

I mapped the nearby MicroAI-Paygate issues (#161 on-chain verification, #163 visible x402 receipts, #165 wallet/gateway error copy, and PR #168's paid-request flow refactor) into a small settlement-path audit table: signed auth vs receipt vs observed USDC Transfer, plus wrong recipient/amount/token/chain, duplicate tx, missing receipt, confirmations, and RPC-failure cases.

Peter/OpenClaw can do either:

• A$690 fixed settlement-path audit: patch-ready truth table + docs/OpenAPI copy + one buyer smoke-test checklist
• A$2,400 one-week x402 conversion room: receipt UX, on-chain verification test matrix, replay/error cases, and maintainer-ready acceptance plan

Public pack: https://a5b50bb6.farmbot-platform-mvp.pages.dev/clovernook/x402-docs-conversion-pack/

If useful, I can share the sample table first and keep it scoped to the settlement/receipt path around this issue.

[AnkanMisra]

Linking #189 as the supporting gap-report for this feature.

Re-confirmed against current main: the verifier performs no on-chain settlement check (only EIP-712 signer recovery + nonce/timestamp/chain_id validation in verifier/src/main.rs), and the gateway grants the paid response on signature validity alone (gateway/main.go, handleSummarize). None of the acceptance criteria here are implemented yet. Issue remains accurate and actionable as written.