[Extension]: Add prepay-audit

### Extension ID

prepay-audit

### Extension Name

AgentPay Pre-Pay Audit — Grade an endpoint before your agent pays it

### Version

1.0.0

### Description

Audit a paid API before money moves: grade the endpoint's 402 terms, see what the live market actually charges, and confirm the wallet can complete the payment right now.

### Author

AgentPay Team

### Repository URL

https://github.com/shawnhvac/spec-kit-prepay-audit

### Download URL

https://github.com/shawnhvac/spec-kit-prepay-audit/archive/refs/tags/v1.0.0.zip

### License

MIT

### Homepage (optional)

https://x402-agent-pay.com

### Documentation URL (optional)

https://github.com/shawnhvac/spec-kit-prepay-audit#readme

### Changelog URL (optional)

https://github.com/shawnhvac/spec-kit-prepay-audit/blob/main/CHANGELOG.md

### Required Spec Kit Version

>=0.1.0

### Required Tools (optional)

- none — all commands call free, keyless HTTPS endpoints

### Number of Commands

3

### Number of Hooks (optional)

1 (optional after_plan)

### Tags

payments, x402, audit, api, usdc

### Key Features

- `/speckit.prepay-audit.check` — grade a paid endpoint's 402 terms from outside with no credentials: 0-100 score, each defect with severity and buyer workaround, all-in cost of one call (price + measured settlement gas against live Base gas and Chainlink ETH/USD), and whether the Payment-Required header survives a default 4KB proxy buffer.
- `/speckit.prepay-audit.ready` — buyer-side handshake before signing: terms complete enough to sign, named facilitator actually answering, gas priced, wallet USDC balance vs price with the exact shortfall when short. Missing/dead facilitator is a warning (buyer can carry its own); gas never blocks a facilitator-settled payment (EIP-3009).
- `/speckit.prepay-audit.market` — the live x402 market scan: hosts probed, which are still live behind a paywall, per-endpoint price/score/pay-to and buyer_notes turning each defect into a concrete workaround. Weekly re-probe; an old scan is labeled, never hidden.
- Optional `after_plan` hook prompts to audit the plan's paid APIs before implementation starts.

### Testing Performed

- All three commands verified against live endpoints (report, handshake, heatmap) — the same rails the community can call: `https://x402-agent-pay.com/facilitator/report`, `/handshake`, `/heatmap`.
- Install tested with `specify extension add` from the release zip; command files load and instructions execute against live infrastructure.
- Verified against Spec Kit v1.0.4.
- Companion extension pay-x402 is already in the community catalog; this extension pairs with it (audit first, then pay under a cap).

### Testing Checklist

- [X] Extension installs successfully via download URL
- [X] All commands execute without errors
- [X] Documentation is complete and accurate
- [X] No security vulnerabilities identified
- [X] Tested on at least one real project

### Submission Requirements

- [X] Valid `extension.yml` manifest included
- [X] README.md with installation and usage instructions
- [X] LICENSE file included
- [X] GitHub release created with version tag
- [X] All command files exist and are properly formatted
- [X] Extension ID follows naming conventions (lowercase-with-hyphens)

### Proposed Catalog Entry

```markdown
- [AgentPay Pre-Pay Audit](https://github.com/shawnhvac/spec-kit-prepay-audit) - Grade an x402 endpoint before an agent pays it: inspect its live 402 terms, estimate the all-in settlement cost, check buyer-side payment readiness, and read the current market heatmap.
```

### Testing Details

The three commands were tested against the live, keyless AgentPay endpoints documented in the repository. The release archive is pinned to `v1.0.0`, and the repository contains the manifest, README, LICENSE, command files, and optional hook.

Review the submitted extension.yml, README.md, command files, LICENSE, and v1.0.0 release archive first, then compare the proposed catalog entry with existing Spec Kit extension entries. Done means the package and submission details satisfy the catalog requirements and the extension can be considered for inclusion.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.