Harden pay against double-settlement and expiry

[iexwr]

Context

pay already asserts status == Open and ledger.timestamp() <= expires_at, which prevents double-pay and late-pay. These invariants are not explicitly tested and the payer argument flow is new.

Acceptance criteria

• A second pay on an already-Paid request aborts.
• A pay after expires_at aborts.
• A pay by an address other than the one passed as payer aborts (auth check).
• cancel after Paid aborts.

Technical notes

• Use the TokenClient mock from soroban-sdk testutils.
• Confirm payer.require_auth() is the only auth gate on pay.

Testing

• New tests: pay_twice_fails, pay_after_expiry_fails, pay_wrong_signer_fails, cancel_after_paid_fails.