feat: prepare Gateway 1.0.1 with GasFree and public APIs

[boboliu-1010]

Summary

• upgrade to the released x402 SDK 1.0.1
• release @bankofai/x402-gateway@1.0.1
• support canonical TRON Permit2 and exact_gasfree payment requirements
• harden facilitator verification, settlement, bounded rate limits, proxy boundaries, admin endpoints, and resource controls
• preserve settlement proof when upstream delivery fails
• expose stable Gateway package APIs, catalog projections, subpath exports, and TypeScript declarations

Release

• npm: @bankofai/x402-gateway@1.0.1
• production image tag to create after merge: v1.0.1

Validation

• npm test (30/30)
• npm pack --dry-run
• npm audit --omit=dev (0 vulnerabilities)
• live TM Permit2 and GasFree challenge smoke tests

Notes

• publish Gateway 1.0.1 before building and publishing CLI 1.0.1
• SunPump upstream HTTP 405 is intentionally out of scope
• automated compensation after settlement with failed upstream delivery remains follow-up work