fix: price MPP challenges in the currency's own minor unit; deps

[vvillait88]

Summary

challengeToRail divided every WWW-Authenticate: Payment amount by 10^6. That is right for the USDC rails and wrong for stripe/charge, whose amount is in cents, so agentscore-pay check rendered a $5.20 card charge on agents.scaledown.ai as $0.000520. Decimals now come from methodDetails.decimals when the challenge declares it, from the ISO code for a fiat quote (2, or 0 for Stripe's zero-decimal currencies), and default to 6 for token rails. A non-USD fiat quote leaves price_usd unset rather than carrying a number in the wrong currency under a field named usd.

This is display and quoting only. The pay command resolves its own decimals for the max-spend check and for the amount it signs, and it never selects the Stripe rail, so no spend path changes. Token rails produce byte-identical output to before; the existing Tempo and Solana assertions pass unchanged.

Dependencies on the same branch: @clack/prompts 1.8.0, typescript-eslint 8.70.0, knip 6.35.0. Every exact pin (viem, mppx, incur, the three @x402/*, @solana/mpp, @agent-score/sdk) is already at registry latest, so the coupled settle set does not move and no live all-rails settle is owed. @solana/kit 8.3.0 and knip 6.35.1 are inside the release-age soak and follow on the next install. The eslint and typescript majors stay held. The dependabot note describing @solana/kit as ^7 now says ^8. OSV over bun.lock: 682 packages, no issues. Actions pins (cosign-installer 4.1.2, osv-scanner 2.5.1) are at upstream latest.

Bumps the version to 0.5.5.

Worked with Varun, who found the wrong figure while checking the ScaleDown storefront's purchase flow.

Deliberately not done: the store's JSON body lists stripe/charge under accepted_methods with the body-level amount_usd, so check still shows that row at the crypto price beside the header row at the card price. That is the MPP body shape carrying one amount for every method, not a parser bug, and the header row is the accurate one.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

None. ChallengeRail.price_usd keeps its type; the value changes only for fiat challenges, where it was wrong.

Test plan

Three tests added in tests/www-authenticate.test.ts: the real Stripe challenge captured from agents.scaledown.ai today (520 cents reads as 5.20), the real Solana challenge from the same response (declared decimals 6 read as 5.000000), and a JPY quote leaving price_usd undefined. Run locally: bun run test (577 passed, 2 skipped), bun run typecheck, bun run lint, bun run knip, bun run build, all exit 0. bun run dev -- check -X POST https://agents.scaledown.ai/credits against the live store shows the Stripe rail at 5.20 with raw 520.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed
• No secrets, credentials, or personal data in the diff or the tests

🤖 Generated with Claude Code