fix: require strict session receipts on all paid success paths

[Slokh]

Follow up fixes to #349

Summary

This PR enforces strict session Payment-Receipt validation for every successful paid session path, including reused persisted sessions. It removes warning-only handling and makes missing/malformed receipts and invalid spent semantics deterministic protocol errors.

What Changed

• Enforced required Payment-Receipt handling on successful paid responses in open/session flow paths.
• Enforced strict receipt validation in streaming paths (response header, SSE payment-receipt event, voucher HEAD/POST updates, and top-up responses).
• Required valid spent semantics (spent present, parseable, and <= acceptedCumulative) across all strict receipt paths.
• Preserved conservative local channel state when a paid top-up response succeeds but strict receipt validation fails.
• Consolidated strict receipt parsing/validation/error helpers into receipt.rs.
• Updated session test harness behavior so success paths return receipts by default, while strict-failure scenarios remain explicitly testable.
• Added/updated integration coverage for reused-session strictness, strict open failures, strict top-up failures, and strict streaming receipt handling.

Diff Scope

• .changelog/strict-session-receipt-enforcement.md
• crates/tempo-request/src/payment/session/flow.rs
• crates/tempo-request/src/payment/session/receipt.rs
• crates/tempo-request/src/payment/session/streaming.rs
• crates/tempo-request/tests/session/harness.rs
• crates/tempo-request/tests/session/spec_alignment.rs
• crates/tempo-request/tests/session/streaming.rs

Behavior Change

• Reused persisted sessions no longer have permissive warning-only receipt handling.
• Successful paid responses without a valid session receipt now fail.

Validation

• make check

[github-actions]

✅ Changelog found on PR.

Edit changelog