fix(server): vary paid middleware responses

[EfeDurmaz16]

Summary

• add Vary: Authorization to Rack 402 payment challenges
• mark successful paid middleware responses Cache-Control: no-store
• keep Payment-Receipt responses authorization-bound to avoid shared-cache reuse

Verification

• mise exec ruby@3.3 -- ruby -Ilib -Itest test/mpp/test_middleware.rb
• mise exec ruby@3.3 -- ruby -c lib/mpp/server/middleware.rb
• mise exec ruby@3.3 -- ruby -c lib/mpp/server/decorator.rb
• mise exec ruby@3.3 -- ruby -c test/mpp/test_middleware.rb
• git diff --check

Note: bundle install could not complete locally because the native rbsecp256k1 build needs aclocal; this patch does not change dependencies and the focused middleware test passes without that native gem.