Subcento — x402 v2 payment flow (read this BEFORE paying; it is free by design)

Paid routes on this host: POST /check (0.002 USDC) and POST /regime (0.0001 USDC).
Nothing else is ever billed. Unknown paths return an unpaid HTTP 404 JSON.

1. CHALLENGE — Call a paid route without payment. You get:
     HTTP 402
     Payment-Required: <base64url JSON>   (x402 v2 challenge)
   Decode the header: it is the single source of truth for the terms —
   scheme ("exact"), network ("eip155:8453"), maxAmountRequired, payTo,
   facilitator ("https://facilitator.goplausible.xyz"), maxTimeout.

2. AUTHORIZE — Build an ERC-3009 signed authorization for USDC on Base:
     from   = your wallet
     to     = payTo from the challenge
     amount = maxAmountRequired (do not overpay; "exact" scheme requires match)
     validAfter/validBefore + nonce per the scheme (see https://docs.x402.org)
   Sign it with EIP-712 using your spending key.

3. RETRY — Repeat the IDENTICAL request (same method, path, body) with:
     X-PAYMENT: {"x402Version":2,"scheme":"exact","network":"eip155:8453","payload":{...}}
   The facilitator verifies and settles the payment; only then does the
   request reach the application.

4. RESULT — A success response (HTTP 200) also carries:
     X-PAYMENT-RESPONSE: <base64 JSON receipt>  (transaction hash, network, success)
   Keep it as proof of settlement. The body itself contains the Ed25519
   signed verdict and "verify_key"; verify the signature independently —
   do not trust the transport, trust the payload.

Failure semantics:
  400 after payment  = malformed request; the payment was settled, content is your bug.
  402                = unpaid challenge (nothing was charged).
  404                = route does not exist (free, never billed).
  503 on /regime     = market snapshot not fresh; nothing billed (payment happens
                       before routing, so retry within the facilitator refund window
                       is NOT automatic — treat 5xx as rare; we log and refund manually: subcento@pm.me).