Built-in Tempo charge provider.

The provider parses a Tempo charge challenge, verifies that the configured RPC is serving the advertised chain, and signs either a TIP-20 transferWithMemo or, when the challenge advertises machineTokenEnabled, the canonical [approve, swapTo] machine-token settlement route. It returns a transaction credential for the server to broadcast.

Configuration is explicit:

• :private_key — required 32-byte private key, raw or hex encoded
• :rpc_url — required Tempo JSON-RPC URL
• :expected_chain_id — optional chain pin, enforced on the charge and subscription paths alike: an advertised chainId that disagrees with it is refused before any RPC or wallet call
• :expected_recipients — optional allowlist of payment recipients. When set, both the primary recipient and every methodDetails.splits recipient must be in the list (case-insensitive / checksum-agnostic). A list that does not include the challenge's primary recipient is rejected before any signing.
• :client_id — optional attribution client identifier
• :fee_token — optional fee token; defaults to the charge currency
• :req_options — optional Req options for the chain-ID check

Transaction tuning options accepted by onchain_tempo (:gas_limit, :nonce, :nonce_key, :valid_before, and :valid_after) may also be supplied. Charge transactions use Tempo's expiring nonce lane by default. A caller-supplied :valid_before is still capped at the challenge expires (mpp-rs #470): 0 means "unset" and becomes the expiry rather than an uncapped envelope.

Non-zero charges always produce a type="transaction" (pull) credential. A challenge whose methodDetails.supportedModes is present and does not list "pull" is declined before any RPC or signing (mpp-rs #455 / #470). Zero-amount charges use type="proof" and ignore supportedModes.