feat: add warning/badge for demo-mode and missing payment evidence (#75)

[Micheal-Blessed]

Resolves #75

Description

SCF reviewers need to distinguish deterministic demo output from real x402/Stellar payment evidence without reading backend logs. This PR adds a warning or badge in the paid result area when the result was produced in demo mode or lacks verified payment evidence.

Acceptance Criteria Met

• Real payment evidence renders as verified or linked when available.
• Demo-mode results render a clear demo/fallback badge.
• Missing evidence never appears as verified.
• The badge is driven by API response fields, not hard-coded UI state.
• Frontend test covers demo and verified states (unit tests added for PaymentEvidenceBanner classification helper).

[vercel]

@Micheal-Blessed is attempting to deploy a commit to the emrekayat's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@Micheal-Blessed Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[emrekayat]

Thanks, I reviewed this from the emrekayat account. The implementation is close and the functional checks are green:

• npm run test --workspace @query402/web
• npm run test --workspace @query402/api
• npm run typecheck --workspaces
• npm run build --workspaces

I cannot merge yet because git diff --check origin/main...HEAD fails on apps/web/src/styles.css with a trailing blank line at EOF. Please remove that extra blank line.

One more cleanup before merge: package-lock.json has peer-flag churn even though this PR does not add dependencies. Please regenerate/revert the lockfile noise so the PR only includes the payment evidence/API/UI/test changes. GitHub is also currently reporting the branch as CONFLICTING / DIRTY, so please rebase or merge latest main if that still shows after the cleanup.

Once those are fixed, this should be straightforward to merge.

[Micheal-Blessed]

@emrekayat resolved.

[emrekayat]

Rechecked from emrekayat. The API idempotency test and the new banner helper tests pass, but the PR is not merge-ready because web typecheck fails.

Passing checks:

• npm run test --workspace @query402/api -- src/routes/protected.idempotency.test.ts
• npm run test --workspace @query402/web -- src/components/PaymentEvidenceBanner.test.tsx src/components/PaymentEvidenceBanner.test.ts

Failing check:

• npm run typecheck --workspace @query402/web

The new apps/web/src/components/PaymentEvidenceBanner.test.ts fixtures omit the required proofLinks field from PaymentEvidenceSummary:

• line 17
• line 36
• line 56
• line 78
• line 100

Please add proofLinks to those fixtures (or adjust the type only if the field is intentionally optional). After that, this should be ready for another pass.