Middleware-safe x402 discovery gate

The x402 discovery surface now lights up only when X402_PAY_TO is configured, so production deploys do not advertise a disabled payment endpoint.