fix: a link cannot nominate its own auditor, and other audit findings

The `watcher` URL parameter was the worst thing in the previous commit. It
existed so a payer could not edit `amount`, but a payer who can edit `amount`
can edit `watcher` just as easily, and honouring it turned the page's honest
"this came from the link" warning into a green "the merchant's server confirmed
these terms" badge issued to whatever host the link named. A phishing link
could vouch for its own price and its own address. The authority is now decided
by whoever deploys the page: a build-time constant, or the page's own origin. A
foreign watcher is named in the warning and ignored.

README: the two mainnet withdrawals were described as "payments made through
this checkout". Decoding the transfers shows both sent their 5 STRK to
0x4ea15bf3, the address that made all five deposits. They exercise the exact
operation an invoice payment uses, and the relayer property is real and worth
showing, but they are not payments to a merchant and the table now says so.

Also:
- Hosted links with no ?id= minted a new invoice id per page load, so the
  double-send guard never matched its own record and a reload paid twice while
  the widget said "it was sent once and will not be sent again". The id is now
  derived from the link's own terms.
- The dashboard no longer keeps a watcher bearer token in localStorage: every
  Pages site on a github.io account shares one origin, so a sibling page could
  read it, or repoint the saved URL and have the dashboard post the token
  somewhere every ten seconds.
- poolFee returns null for a token it is not denominated in. get_fee_amount()
  takes no argument, so there is one fee and it is STRK; decoding it with an
  ETH invoice's decimals printed "6 ETH" and added it to a total.
- The dev server refuses non-loopback Host headers and anything under a dot
  directory: it serves the repository, so /.git/config was a 200.
- React effect deps gained mode, expiresAt and store.
- The documented confirm() example resolved to an object, and every object is
  truthy, so {"paid": false} shipped the goods.
- Docs corrected where they overstated: what e2e:watcher proves, "refuses every
  request" against two deliberately public routes, "no wildcard" against the
  payer route's *, "shield if needed" against a widget that refuses to, and the
  fee's direction everywhere it appears.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>