fix(ts): address R7 QA findings and validate payment runtimes

[boboliu-1010]

Changes

Fix the remaining v4.14 QA failures in credential output, payment validation, order pagination and registration metadata loading. B.AI retains Base support, recipient recharge and initial wallet binding.

• Redact GasFree and TronLink credentials in config reads and write receipts; reject ERC-8004 zero-address transfers before RPC.
• Classify x402 HTTP 429 as provider_rate_limited, retain safe numeric Retry-After hints, and preserve the no-automatic-repayment rule.
• Cap B.AI order requests at the backend's 100-row limit, preserve offsets across page boundaries, and report the effective limit with a warning.
• Restrict registration metadata reads to HTTP/HTTPS without redirects, with a maximum JSON depth of 20 and a 10-second timeout cap. Register/update URI validation remains separate.
• Remove search internals and inline endpoints from provider listings; add sanitized server access logs.
• Add raw amounts, explicit asset precision, authorization validity and advertised resource URLs to the applicable server commands. Add daemon readiness/PID/log output and signal cleanup for Node and Bun standalone runtimes.
• Add B.AI recharge dry-run and GasFree controls. Resolve account ambiguity and validate relay configuration before creating an order. Preview never creates an order, unlocks, signs, pays or reports a transaction; unavailable final fee estimates remain explicit.
• Build fresh dist before package verification and include daemon lifecycle coverage in installed-package tests.

Validation

• Full suite: 2,886 passed, 46 skipped, 0 failed. Of the skipped tests, 44 require an installed entrypoint and ran in the package suite; two opt-in live deployment tests were not enabled.
• Fresh package installation: 71 passed across eight test files.
• Typecheck, lint, format check and dependency-cruiser passed.
• Node and macOS arm64 standalone: all 20 new command helps, input exclusions, credential redaction, daemon readiness/discovery/log permissions and SIGTERM cleanup passed.
• Standalone daemon regression and native-addon smoke checks passed.
• Live provider list/show/endpoint-list succeeded.
• Current build successfully read an existing Agent on Nile and completed a software-wallet sign-only transaction using real RPC, without broadcasting.

No npm publication. Real B.AI crediting, live x402 settlement, mainnet payments, physical hardware signing and Windows/Linux standalone execution were not performed in this validation run. Suite totals overlap and should not be added together.