fix(x402): settle Arbitrum One deposits via CDP with checksummed v2 payload

[gianalarcon]

What

Enable agentic gasless USDC (x402) deposits on Arbitrum One (42161) by routing them through the Coinbase CDP facilitator (x402 v2), and fix the CDP v2 payload that was being rejected.

Why

• PayAI (our x402 v1 facilitator) advertises "arbitrum" in /supported but rejects it on verify with invalid_exact_evm_network_mismatch — confirmed on prod for both Arbitrum One and Arbitrum Sepolia. So PayAI cannot settle Arbitrum.
• CDP is the only facilitator that settles Arbitrum One (per CDP network-support: Base, Base Sepolia, Polygon, Arbitrum One, World, Solana). CDP does not support Arbitrum Sepolia.

Changes

• Chain-aware routing (resolveFacilitator): Arbitrum One (42161) → CDP; Base + everything else stay on PayAI v1 (untouched). CDP_SUPPORTED_NETWORKS + assertCdpNetworkSupported guard fails fast for chains CDP can't settle.
• CDP v2 payload fix (the actual blocker): CDP's v2 validator requires EIP-55 checksummed EVM addresses. We were sending lowercase (multisig addresses are stored lowercase; the X-PAYMENT authorization carries lowercase), so the payload failed CDP's oneOf[x402V2PaymentPayload, x402V1PaymentPayload] and surfaced the misleading "x402V1PaymentPayload requires 'scheme'" error. Now checksum asset/payTo in the v2 requirements leaf and authorization.from/to in the payment payload via viem getAddress. Casing does not affect the EIP-3009 signature (EIP-712 encodes addresses to the 20-byte value).

Verified

• ✅ Schema conformance against CDP's own SDK OpenAPI types + the canonical x402 exact-EVM spec.
• ✅ Clean type-check (yarn workspace @polypay/shared build + @polypay/backend build).
• 🚩 Needs a live Arbitrum One test deposit (real multisig + USDC) to confirm CDP /verify + /settle accept the checksummed body end-to-end — CDP can't be fully exercised in CI/locally.

Deploy notes

• Staging is testnet; Arbitrum One can't be exercised there, so final confirmation must happen after this reaches prod.
• Prod relayer needs Arbitrum One ETH funded before the live test (account-creation deploy).

🤖 Generated with Claude Code