fix(api): gate x402 video quota before settlement

[cursor]

Bug and impact

Anonymous x402 callers could pay for video-generate after their hourly video cap was already exhausted. The x402 middleware verified and settled payment before the route-level videoHourlyGate ran, so the handler could return 429 video_rate_limited after the payer had already been charged.

Root cause

toolMiddleware("video-generate") runs x402Middleware before the tool handler. The video hourly cap lived only in the handler, after x402Paid was set post-settlement.

Fix

• Added a video-generate x402 pre-settlement quota gate after payment verification and before settlement.
• Releases the reserved video slot if settlement fails.
• Passes the reserved identity into the route so x402-paid requests are not counted twice.
• Added focused regression assertions to the hardening audit.

Validation

• npm run build
• node tests/hardening-caps-audit.test.mjs