fix(paywall): use dynamic token decimals instead of hardcoding 6

[ryanRfox]

Description

The EVM paywall displays incorrect amounts for any token that does not use 6 decimal places. An 18-decimal token priced at 0.001 raw units renders as $1,000,000,000 because the code divides by 10^6 everywhere.

Fixes #1979
Related: #1976

Root Cause

The paywall was built assuming USDC (6 decimals) is the only payment token. This assumption appears in three places:

1. Server-side HTML generation (index.ts) divides the raw amount by a hardcoded 10^6 to produce the display value injected into the template.
2. Client-side balance display (EvmPaywall.tsx) calls formatUnits with a hardcoded 6 and reads the token address from a 3-chain USDC lookup table that returns 0 for any other chain.
3. Balance utility (utils.ts) only knows USDC addresses on Ethereum, Base, and Base Sepolia — every other chain silently shows a zero balance.

Fix

Server-side (index.ts): Look up the token's decimal precision from a known-decimals map aligned with DEFAULT_STABLECOINS. Only non-6-decimal chains need entries; everything else falls back to 6. This keeps the server-side path simple with no RPC calls.

Client-side (EvmPaywall.tsx): Read the token contract address from the payment requirement's asset field (which the server already populates) and query the standard ERC-20 decimals() function on-chain. This works for any compliant token without maintaining a lookup table.

utils.ts: Replace the USDC-specific getUSDCBalance (internal helper, not part of the public API) with generic getTokenBalance and getTokenDecimals functions that accept a token address parameter. The function signature changes from 2 args to 3, but no external consumer can import it — it is only used by the bundled React component inside the paywall HTML template.

Breaking Change Note

The internal helper getUSDCBalance in utils.ts is removed and replaced by getTokenBalance (different signature: takes an explicit token address instead of looking it up by chain ID). This function is not exported from the package's public API — it is only consumed by the bundled EvmPaywall React component inside the paywall HTML template. No server operator code calls it directly. However, anyone who has forked the paywall and imports from the file path (bypassing package exports) would need to update their import and call site.

Regenerated Go, Python, and TS paywall templates.

AI Disclosure

This PR was prepared with the assistance of a coding agent and reviewed by Ryan R. Fox (an actual human) before submission.

Testing

• All existing tests pass (pnpm test — 41/41 tasks)
• Lint clean (pnpm lint:check)
• Format clean (pnpm format)
• Backward compatible: unknown chains fall back to 6 decimals

Checklist

• Code formatted and linted (pnpm format && pnpm lint:check)
• All new and existing tests pass (pnpm test)
• Commits are signed
• Changeset fragment added
• Generated paywall templates rebuilt (pnpm --filter @x402/paywall build:paywall)

[vercel]

@ryanRfox is attempting to deploy a commit to the Coinbase Team on Vercel.

A member of the Team first needs to authorize it.

[ryanRfox]

Note: #1926 fixes the same hardcoded-decimals bug in the server-side fallback paywall (x402HTTPResourceServer). This PR fixes the client-side React paywall (@x402/paywall). The two PRs are complementary — different packages, different code paths, both need the fix.