fix: bind tempo attribution memo suffix to challenge id

[brendanjryan]

Summary

• bind SDK-generated Tempo attribution memos to the current challenge by reusing the trailing 7 bytes
• add same-challenge replay protection in Mppx via NonceSet and a reserved internal challenge nonce
• keep explicit custom memos and plain/no-memo transfers on the existing store-backed fallback path

Testing

• pnpm check:types
• pnpm exec vitest run src/internal/NonceSet.test.ts src/tempo/Attribution.test.ts src/server/Mppx.test.ts
• pnpm exec vitest run src/tempo/server/Charge.test.ts

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/mppx@232

commit: bb3d827

[brendanjryan]

going to close this for now -- we are considering other approaches including increasing memo size so that we can pack the full challengeId