test: cover the guards a mutation pass could delete unnoticed

Round 6 broke 79 guards and found 40 of them left the suite green. These are
the ones that protect money or authenticity, each now verified by deleting it
and watching a test fail:

- unsigned webhooks are refused when WEBHOOK_SECRET is unset
- an empty secret verifies nothing, tested with a signature actually forged
  using the empty key rather than a different one
- a new delivery id per event, so a merchant deduping as documented cannot
  swallow the confirmation that follows an underpayment
- Idempotency-Key bound to the request, so a reused key cannot return the old
  10 STRK row for a 500 STRK order
- baseline-less rows quarantined on restore rather than judged on an absolute
  balance

Two of these needed their own test files: WEBHOOK_URL, WEBHOOK_SECRET and
STORE_PATH are read into module constants at import, so a test that sets them
afterwards proves nothing. The first version of the unsigned-webhook test
passed for exactly that reason and has been replaced.

Also from round 6, statements the code did not honour:

- The honesty panel told every payer the checkout would not shield for them,
  with no knowledge of allowInlineShield. The arcade turns it on, so the first
  thing anyone sees stated a policy the widget was about to break. It now says
  which one applies.
- e2e-live's replay check was rejected by the freshness window before any HMAC
  was computed, so it would have passed with the timestamp ignored entirely.
  It now also checks the binding directly.
- The WalletAdapter interface comment, the integration guide's pricing section,
  and pay-live's link creator all still described the fee as charged "on top of
  the amount". That is the direction that cost a release. All corrected, and
  the creator no longer offers a watcher field the page ignores by design.
- The README claimed pay-live refuses links its server does not recognise. It
  warns; it does not refuse. It now says so.
- The dashboard's Create invoice could not work cross-origin at all, because
  Idempotency-Key was missing from Access-Control-Allow-Headers.

149 tests.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>