Fulfill mandate

Re-validates the request against the signed mandate terms (slug allow-list, merchant allow-list, per-fulfillment cap, total budget, expiry) and forwards through the gateway internally on success.