Take x402 2.19.0 in the lock, which an earlier merge dropped (#112)

## Summary

Lands the `x402` 2.18.0 to 2.19.0 lock bump that was written and
reviewed earlier today but never actually merged: the branch carrying it
was PR'd at the commit *before* it, so main kept resolving 2.18.0 while
that PR's body said the bump was included. Caught while pruning stale
branches, by comparing branch content against main rather than trusting
ancestry (squash merges rewrite SHAs, so "not fully merged" proves
nothing either way).

2.19.0 is a security fix. `x402_http_server_base` normalized a request
path by decoding percent-escapes globally, so a decoded byte could
create a segment boundary the router never saw, and a wildcard tail
carrying a decoded line feed failed to match its own route, skipping
payment verification and settlement outright. 2.19.0 decodes one segment
at a time and re-escapes any separator a decode yields.

**Scope is our own test and dev resolution only.** The declared range is
`x402[evm,fastapi]>=2.9,<3` and is unchanged, so anyone installing the
`x402` extra already resolves 2.19.0 or newer. Nothing published was
affected, and no release is needed for this.

## Type of change

- [ ] Bug fix (no breaking change)
- [ ] New feature (no breaking change)
- [ ] Breaking change (existing callers must update)
- [x] Docs, tests, or internal maintenance only

## Public API

None. Lockfile only; the declared dependency range does not move.

## Test plan

`ruff check` clean, `ty check agentscore_commerce/` clean, `pytest
tests/` 1861 passed / 4 skipped with coverage 95.35% against the 95%
floor, all against the upgraded lock.

## Checklist

- [x] Tests cover the new behavior, and the suite passes locally
- [x] Lint, format, and type checks pass
- [x] Docs and README examples updated if the public surface changed
- [x] No secrets, credentials, or personal data in the diff or the tests

Author: vvillait88