docs: adopt Discipline charter + ADRs + ARCHITECTURE

[marceloceccon]

What

Adopt the Web3Settle Discipline.md engineering charter in merchant-sdk and author repo-specific ADRs grounded in src/. Additive docs only — no product code, tests, or CI touched.

Added

• Discipline.md — copied verbatim from the platform charter.
• docs/adr/README.md — ADR index mirroring the monorepo root's; continues the platform numbering (root owns 0001–0002; SDK starts at 0003) and points to the platform-wide ADRs without duplicating them.
• 3 repo-specific ADRs, each grounded in code:
  • ADR-0003 — Browser trust boundary / signed payment-config. The SDK runs in untrusted customer browsers; fetchPaymentConfig (src/core/api-client.ts) fails closed through a 4-step gate: Zod shape → Ed25519 signature vs baked-in pubkey over signed_at + canonical_json(data) → freshness → contract-address/ABI allow-lists. Trust anchor is the published artifact, not the wire; splits trust so a backend compromise alone can't redirect funds. (payment-config-verifier.ts, canonical-json.ts, config.ts)
  • ADR-0004 — KNOWN_PERMIT_TOKENS permit allow-list. signPermit refuses EIP-2612 signing for tokens whose EIP-712 domain digest isn't allow-listed (typo-squat defence: a clone spoofing name()="USD Coin" has a different verifyingContract → different digest), before any wallet popup; unknown-but-real tokens fall back to approve(). Documents the known test follow-up: the older permit.test.ts happy-path cases assert the pre-allow-list path (left for a separate code PR). (src/evm/permit.ts)
  • ADR-0005 — Telemetry redaction / no phone-home. Opt-in synchronous callback only; the SDK makes no telemetry network calls; salted non-reversible wallet digest (never the address); redactErrorMessage strips addresses/hashes/UUIDs/base58/paths/long-hex before emission. (src/core/telemetry.ts)
• ARCHITECTURE.md — subpath/entry map (., ./solana, ./tron, ./headless, ./wc), the 4-step trust gate, multi-chain PaymentPipeline adapters, build/publish, and a customer-browser → SDK → gateway/chain ASCII diagram.

Tooling note (charter adaptation)

The charter's §7 example mandates pnpm + tsup. This repo's actual build is npm + Vite library mode + vite-plugin-dts, with Vitest (already charter-aligned). The docs reflect reality per charter R8/R11; no third-party tools were installed and the build was not retooled. Flagged explicitly in ARCHITECTURE.md.

Scope / safety

• Additive docs only: git diff main shows no changes to tracked code/tests/CI.
• Untracked SECOPS-SCAN/ was deliberately not staged.
• All ADR↔source relative links verified to resolve.