[DIRECT] Add a fail-closed API test for stale domain origins

[joan-bisbal]

Closes #684 - Adds fail-closed test ensuring canonical origins (agentbounties.app, api.agentbounties.app, mcp.agentbounties.app) are accepted while retired legacy origins are rejected. Covers both origin validation and generated link validation. Fully offline: no DNS, HTTP, credentials, or live wallet.

[NSPG13]

Maintainer compatibility pass before today's bounded-wallet reconciliation fix:

• The contributor-safety/docs-contract gate passed.
• This PR changes runtime code, so it still requires its normal line-by-line behavior and security review before main readiness is decided.
• It does not overlap the planned narrow fix in site/agent-budget.js and its focused regression test. That fix only waits for confirmed Base allowance state after a receipt and does not change contracts, payment amounts, or the PR's public contract.

No rebase or contributor rework is requested because of today's maintenance. I will evaluate this PR's own acceptance criteria separately and give specific commands/files if changes are needed.

[NSPG13]

The PR is in the manual-security-review lane because origin validation is security-sensitive. What passed: it targets issue #684. What blocks main: it overlaps #692, #740, and #743 and must prove proxy/header behavior without breaking canonical hosted origins. Action: consolidate or explain the unique scope, run cargo run -p cli -- docs-contract-check and cargo test -p api, and add allowed, stale, malformed, and forwarded-origin fixtures. Done when the allowlist is explicit and tested. Thanks for helping the community grow, and sorry for the review friction.

[joan-bisbal]

This PR addresses a unique scope for issue #684 to test explicit fail-closed origin validation. It does not conflict with the mentioned overlapping PRs. We have added the allowed, stale, malformed, and forwarded-origin fixtures requested.