feat(wangapayfast-rs): add ITN hardening helpers (ip/replay/timestamp)

## Summary
Add production-focused ITN verification helpers beyond signature checks.

## Scope
- Optional IP/domain allowlist helpers
- Replay/idempotency key helpers
- Timestamp freshness validation utilities
- Security usage examples

## Acceptance Criteria
- Helpers are optional and documented
- Clear guidance for secure ITN processing exists
- Tests cover happy path and rejection cases