466dafde - Fix EVM payout allowlist address matching

[TaprootFreak]

What

• compare EVM payout allowlist entries case-insensitively
• enforce exact, case-sensitive matching for non-EVM chains
• ignore malformed non-string allowlist entries so the gate fails closed
• cover the checksummed Ethereum address regression with synthetic EIP-55 fixtures

Root cause

The payout endpoint lowercased the incoming address before comparing it with the configured manualPayoutAddresses values. A checksummed EVM address stored with uppercase checksum characters therefore failed the exact string comparison and returned Payout address not permitted.

Safety

• normalization is restricted to blockchains in EvmBlockchains
• the original address is still passed unchanged to the payout service
• non-EVM requests now require exact casing; this is an observable hardening of the previous inconsistent lowercase-only request comparison
• unknown EVM addresses and malformed allowlist settings are rejected before liquidity reservation or payout

Verification

• m5me mutation proof before the security fixture rewrite: reverting the same normalization made the EVM regression test fail; restoring it made the control pass
• final independent logic and conformity/security reviews after 2 rounds: 0 findings
• final GitHub CI: build, type-check, lint, formatting, all 3 Jest shards, coverage and ratchet, review bot, CodeQL, and security analyses passed
• final review-bot counters: TSC_ERRORS: 0, ESLINT_ERRORS: 0
• the single PR commit is verified as validly signed by GitHub
• m5me became unreachable through its Cloudflare tunnel before the final synthetic-fixture head; the final head was therefore validated by the complete GitHub CI matrix above

[TaprootFreak]

Final two-lens review reached 0 merge-blocking and 0 non-blocking findings after 2 review rounds. The branch was rewritten to remove the reported address from the current public PR history. The final head passed every required GitHub check; the review bot reports TSC_ERRORS: 0 and ESLINT_ERRORS: 0, and the single PR commit has a valid GitHub signature.