fix: verify credit top-ups on-chain and bind claims to payer

[kutluhaneth46]

Summary

• Stop trusting client credits / usdcAmount / destinationAddress on POST /api/transactions (unlimited credit mint).
• Resolve the admin recipient server-side (ADMIN_WALLET_ADDRESS or admin_wallets, same source as /api/destination-wallet).
• Derive credit amount from the on-chain USDC Transfer log (bigint micro-USDC; rate matches the purchase UI: 1 USDC = 1 credit).
• Require a personal_sign claim over buildTopupClaimMessage(chainId, txHash) from the paying wallet so another authenticated session cannot claim a victim's payment.
• Support Arc Testnet (5042002) via the sample RPC default; other chains via optional RPC_URL_* env vars.

Related discussion on #56 (same problem; this closes the recipient override and cross-session claim holes called out there).

Test plan

• Purchase credits on Arc Testnet with a funded wallet — transfer + claim signature → credits recorded from on-chain amount
• Replay the same txHash from a second account session → 409 / no credit
• POST with attacker-controlled destinationAddress in body → ignored; only admin wallet Transfer matches
• Unsupported chain without RPC_URL_* → 400 Unsupported chain