feat: add split credential lifecycle and Tempo API relay

[brendanjryan]

Motivation

Servers need a non-mutating credential preflight separated from terminal payment execution, plus a first-party way to delegate Tempo charge validation and broadcast to the Tempo API relay.

Summary

• add validation records and split validate / broadcast server lifecycle APIs
• preserve legacy verify behavior while routing terminal operations through revalidation
• add Tempo charge lifecycle hooks and a relay adapter for validate and broadcast endpoints
• expose safe relay failure details and deterministic broadcast idempotency keys
• add a FastAPI charge-relay example aligned with the mppx setup
• expand lifecycle, binding, relay, replay, and error coverage

Key design considerations

• validation is non-mutating; broadcast always invokes validation first
• standalone lifecycle methods verify HMAC challenge binding, request identity, and expiry
• relay failures remain opaque except for explicitly safe machine-readable codes
• pull transactions and pushed transaction hashes share the same relay finalization path