Fix JWT payment scope bypass

[jillesme]

Summary

Fixes a payment bypass where an auth_token cookie issued after paying one protected route could be reused on any other protected route in the same deployment.

Changes:

• Bind JWT auth cookies to the paid route/payment scope: host, route pattern, amount, currency, pay-to wallet, Tempo network, and payment method/version.
• Require exact scope match before cookie auth bypasses MPP payment.
• Scope newly issued cookies to the protected route path instead of deployment-wide Path=/.
• Reject legacy unscoped JWT cookies and expire old root-scoped cookies when issuing scoped ones.
• Prefer the most specific matching protected pattern to avoid broad cheap wildcard routes shadowing narrower expensive routes.
• Update README to describe scoped cookie behavior.

Validation

• npm run lint

Security note

After deploying this fix, rotating JWT_SECRET is recommended to immediately invalidate any previously issued deployment-wide cookies.