OrbitSafe approves paid calls, blocks rogue spend, and leaves an auditable trail across x402 and MPP.