billing: guarded Base funding and x402 settlement

[halfaipg]

Summary

• add immutable Base USDC/AIPG/ETH funding receipts backed by integer micro-USD credits
• keep USDC, AIPG, ETH, and x402 independently default-off
• add conversion-backed ETH receipts that credit only actual canonical Base USDC proceeds
• journal x402 before settlement and unlock worker payout only after independent exact-transfer proof
• add migration, operational caps, alerting, CLI reconciliation, docs, and canary runbook

Safety

• migration 0018 must deploy before code
• all new production flags stay off on merge
• no real funds moved by this PR
• credits are explicitly non-transferable and nonwithdrawable

Verification

• 334 service/router tests passed; 7 environment-gated tests skipped in that run
• all 7 Postgres concurrency tests passed separately
• Alembic upgrade/check/downgrade/re-upgrade/check passed on disposable Postgres 14
• pip-audit: no known vulnerabilities
• Semgrep: no findings in changed money-path files
• gitleaks staged scan: no leaks