Adds the `upto` scheme alongside the existing `exact` flow:

- `signUptoPayment` — EIP-712 typed-data signing over Permit2's
  PermitWitnessTransferFrom struct (witness binds {to, facilitator,
  validAfter}), with decimal-string uint256 nonce.
- One-time Permit2 ERC-20 allowance auto-approval — checks
  `USDC.allowance(wallet, PERMIT2)` and submits
  `USDC.approve(PERMIT2, MAX_UINT256)` if short. Bypassable with
  `--no-approve` for advanced/testing flows.
- `selectAcceptEntry(accepts, preference)` — picks a valid accept
  from the 402 `accepts[]` array. `auto` prefers `upto`, falls back to
  `exact`; explicit `upto` or `exact` forces one.
- `parsePaymentRequired` and `extractAcceptFromPaymentRequired`
  now use the selector instead of hard-coding `exact`.
- `mcpc x402 sign` gains `--scheme <auto|upto|exact>` and
  `--no-approve` flags.
- 30 Vitest unit tests cover the new code paths.

Spec: https://github.com/coinbase/x402/blob/main/specs/schemes/upto/scheme_upto_evm.md

End-to-end validated against api.apify.com on Base Mainnet:
- HTTP 402 returns both schemes in accepts[]
- mcpc x402 sign --scheme upto produces a wire-correct payload
- POST with PAYMENT-SIGNATURE returns 201 + payment-response (success: true,
  transaction: '' — settlement deferred to the apify-core daemon per spec)

Known follow-up (not blocking review):
- `--scheme` preference not yet plumbed into the session-level `--x402`
  flow (only the manual `x402 sign` command honors it today).

Investigation doc in X402_UPTO_INVESTIGATION.md captures the on-chain proof,
the original CDP /verify schema gap (resolved upstream by now — prod
verifies upto fine), and the debugging history.

…etry paths

`--x402-scheme` previously only kicked in on the HTTP-402 fallback. Two other
signing paths defaulted to `auto` and signed whatever the server preferred:

1. The proactive-sign path (`getOrSignPayment`) read only the flat
   `_meta.x402.{scheme,…}` fields, missing the new `accepts[]` advertising
   and ignoring `schemePreference` entirely.
2. The tool-result retry path (`extractAcceptFromPaymentRequired` called from
   `BridgeProcess.handlePaymentRequiredRetry`) hard-coded `selectAcceptEntry(..., 'auto')`.

Both now honor the configured preference end-to-end:

- `createX402FetchMiddleware` passes `schemePreference` into `getOrSignPayment`.
- New `selectAcceptFromToolMeta` helper consumes `_meta.x402.accepts[]` when
  present (post apify-mcp-server #876), falling back to flat fields only when
  the preference matches the flat scheme (or preference is `auto`).
- `extractAcceptFromPaymentRequired` takes a `schemePreference` parameter and
  the bridge passes `this.options.x402Scheme` through to it.

When the proactive path can't honor the preference (e.g. pre-#876 server with
flat-only `_meta.x402.scheme=upto` and `--x402-scheme exact`), it skips signing
and lets the 402 fallback handle it \u2014 the 402 response is the authoritative
source of `accepts[]` regardless of what the server advertises proactively.

Refs #238 review comment from @TateLyman.

New `fetch-middleware.test.ts` covers:
- proactive sign with accepts=[exact, upto] and schemePreference=exact \u2192 signs exact
- proactive sign with accepts=[exact, upto] and schemePreference=upto \u2192 signs upto
- proactive sign with accepts=[upto] and schemePreference=exact \u2192 skips
- proactive sign with legacy flat-only upto and schemePreference=exact \u2192 skips
- proactive sign with default auto preference \u2192 prefers upto
- extractAcceptFromPaymentRequired with each preference value

…ADME

- Explains `exact` (EIP-3009) vs `upto` (Permit2) scheme semantics.
- Documents `--x402-scheme <auto|upto|exact>` session configuration and persistence.
- Adds `--scheme` and `--no-approve` options to `mcpc x402 sign` table.
- Cleans up type duplication of `SchemePreference` by aliasing `X402SchemePreference` imported from types.ts.

When the bridge process crashes in the background, `restartBridge` reads the saved
session record from `sessions.json` and spawns a new bridge. Previously, it only
forwarded `session.x402: true` to `bridgeOptions` but forgot to plumb
`session.x402Scheme` (the pinned preference). This caused the restarted bridge
to revert to the default `auto` scheme preference, violating the pinned session policy.

Now correctly forwards `session.x402Scheme` on automatic crash restarts.

Refs Rule 25: Plumb user-visible configurations end-to-end to avoid leaky parameter gaps.

…p dead conditional in upto signer

Two small leaky-parameter findings from a second-pass review (Rule 25 in code-quality skill):

1. `BulkConnectOptions` did not declare `x402Scheme`. The value was passed
   implicitly via `{ ...globalOpts }` spread to `connectAllFromConfig` /
   `connectAllFromStandardConfigs`, so it survived at runtime, but the typed
   parameter view dropped it \u2014 fragile to any future refactor that destructures
   the options object instead of re-spreading it. Declare the field and add
   explicit spreads at the two CLI call sites so the contract is type-enforced.

2. `signUptoPayment` built the accepted.extra block with
   `...(facilitatorAddress ? { facilitatorAddress } : {})`, but the function
   throws earlier when `facilitatorAddress` is empty \u2014 the false branch was
   unreachable. Inline the field directly with a one-line invariant comment.

- normaliseLegacyX402: drop the x402Scheme sidecar branch. That two-field
  shape only existed mid-feature-branch (0d65e96..adb6a6b); no released
  version ever wrote it to disk. Keep only the v0.3.0 `{x402: boolean}`
  → `auto` migration and bogus-value defense.
- Bridge --x402 parser: throw on missing/invalid value instead of silently
  falling back to 'auto'. CLI already validates strictly; the tolerant
  branch was dead code that would hide bugs from direct bridge invocation.
- README upto section: compress the 3-bullet + 4-step explanation into
  one paragraph. Same information, half the lines.

Commander's `[optional]` arg parser greedily consumes the next token as
the option value, so `mcpc connect --x402 mcp.apify.com @s` would parse
the URL as the scheme. Pre-process argv in `main()`: when `--x402` is
followed by a token that's not in {auto, upto, exact}, rewrite to
`--x402=auto` so the next token stays a positional. Tokens that are
valid schemes pass through unchanged.

Validated end-to-end against mcp.apify.com: `mcpc connect --x402
'https://mcp.apify.com?payment=x402&actors=apify/instagram-scraper' @s`
now succeeds and signs an upto-scheme payment to the facilitator.

Drops the now-redundant `--x402=<scheme>` workaround note from
`connect` help, README, and CHANGELOG. Also removes the dead
`x402?: boolean` field from `extractOptions()` (unread since the
`--x402-scheme` collapse in adb6a6b).