fix(video): close the three money-path holes 0.38.1 left documented (0.39.1) - #101

All three were flagged by the 0.38.1 review, recorded in that CHANGELOG as
"known and unfixed", and pre-existing since well before the Seedance work.

1. UNREADABLE 402 -> FAIL CLOSED. amountToUsd returning null used to skip
   the re-reserve, sign the raw unvalidated amount, and book only the
   estimate — the last way past the budget cap. Now it aborts before
   createPaymentPayload with "no charge was made". Pinned: nothing signed,
   one fetch (the quote), reservation released, for six malformed shapes.

2. SSRF GUARD on image_url / last_frame_url, mirroring blockrun_image:
   http(s)-only schemes, then isBlockedFetchHostResolved on the hostname —
   resolved, not literal, so 127.0.0.1.nip.io-style names are caught. The
   MCP never fetches these itself; the gateway does. Defense-in-depth plus
   a saved paid round trip. Pinned: four hostile shapes refused with ZERO
   network calls; a public https URL still flows.

3. BOOK ON SETTLEMENT OBSERVATION. The gateway settles on the first poll it
   answers "completed"; the old path validated the payload first, so a
   completed body missing its clip URL threw, and finally released the
   reservation — real USDC spent, ledger unchanged, cap silently raised.
   Booking now happens the instant "completed" is observed. Pinned: the
   malformed-completed case keeps $0.40 in the ledger while still erroring;
   "failed" still books nothing.

The first draft of fix 3 double-booked the happy path (poll site + old tail
call — a replace hit the wrong occurrence). The new suite's exactly-once
ledger assertion caught it before commit, which is the whole argument for
asserting on money, not messages.

309 tests pass, typecheck green.