feat: import OpenAPI descriptions into resource drafts

[Revinand]

Summary

Adds agent-commerce import openapi <file>, which reads a local OpenAPI
3.0/3.1/3.2 document (YAML or JSON) and writes Agent Commerce resource drafts
for review. Merchants who already describe their API in OpenAPI no longer have
to hand-write the resources: block.

The importer produces configuration and stops there. A human reviews the
drafts and merges them into config.yaml, and from that point an imported
resource goes through the same parser, registry and pipeline as one typed by
hand.

Pricing and exposure are never inferred: without --free and --expose the
fragment has no pricing or expose keys and will not load until someone
decides them. Credentials are never imported either. Anything the gateway
cannot represent, such as a required multipart body or a deepObject query
parameter, skips the operation rather than being approximated; the optional
equivalents are omitted with a warning. docs/openapi-import.md has the full
support matrix.

One runtime change comes with it. BackendHandler gains an optional
inputBindings field, exposed as backend.inputBindings, so a request can
carry path parameters, query parameters and a JSON body at once. Absent
bindings keep the old behaviour exactly, so existing configs are unaffected.
PROTOCOL_NAMES was also added so config validation and --expose check
protocol names against one definition. Both are recorded in
docs/contracts.md.

@scalar/openapi-parser@0.29.0 is a new dependency. It needs zod 4, so the
repo-wide overrides.zod was narrowed to the three x402 packages that share
zod values with ours. A default install goes from about 48 MB to about 65 MB,
and the README claim was updated.