fix(solana): async re-sign payment guard + poll_url host pinning

[VickyXAI]

What

Closes the two follow-ups #19 explicitly deferred in its own commit message.

1. Async mid-poll re-sign payment-terms guard (parity with sync)

The sync poll loop rejects a re-signed 402 challenge whose amount or recipient changed vs. what the job originally authorized (_assert_same_payment_terms). The async path did not — it re-signed whatever the gateway quoted. Now:

• The async media helper inlines the submit-time signing (instead of _sign_payment_from_response) so it can capture the original amount/pay_to.
• The async re-sign block mirrors the sync structure exactly: the guard runs outside the try/except, so a re-price PaymentError propagates instead of being swallowed and masked as a generic 402.

2. poll_url host + scheme pinning (SSRF / signed-header exfiltration)

_absolute_url (sync + async) now pins an absolute poll_url to the API origin. The poll loop sends — and now re-signs — the wallet's PAYMENT-SIGNATURE against poll_url; a gateway response redirecting it off-host (or downgrading https→http) would leak the signed payment. Absolute cross-host/scheme URLs are rejected; relative URLs resolve against the API host as before.

Tests (tests/unit/test_solana_media.py)

• End-to-end re-sign through the real poll loop, sync and async: same-terms re-sign completes; a re-price propagates as PaymentError.
• poll_url host-pin: relative resolved, same-host passes, cross-host rejected, http-downgrade rejected.

Validation

black + ruff clean; 294 passed (pytest tests/unit). No new mypy errors vs main (pre-existing .json()/price patterns only).