Never trust the client: verifying on-chain payments server-side

Replace this with the real walkthrough. Suggested outline:

1. Why a client-reported transaction hash is never proof of payment.
2. Fetching and decoding the transaction receipt server-side (EVM) or the confirmed transaction (Solana).
3. Confirmation-depth thresholds and why they matter.
4. The database constraint that prevents replaying the same transaction against two orders.
5. What actually broke the first time you tried this in production.