fix(core): reject malformed payment signature headers early

[Bortlesboat]

Fixes #800.

Summary

• validate decoded PAYMENT-SIGNATURE payloads up front with the existing schema
• return a 400 payment error for malformed base64, JSON, or payload shapes before route pricing runs
• add focused HTTP resource server coverage to prove malformed headers never reach verification

Verification

• pnpm --dir typescript/packages/core test -- test/unit/http/x402HTTPResourceService.test.ts
• pnpm --dir typescript/packages/core test -- test/unit/http
• pnpm --dir typescript/packages/core exec prettier --check src/http/index.ts src/http/x402HTTPResourceServer.ts test/unit/http/x402HTTPResourceService.test.ts
• pnpm --dir typescript/packages/core exec eslint src/http/index.ts src/http/x402HTTPResourceServer.ts test/unit/http/x402HTTPResourceService.test.ts

[vercel]

@Bortlesboat is attempting to deploy a commit to the Coinbase Team on Vercel.

A member of the Team first needs to authorize it.