HTTP 402 was a ghost for 30 years. Now that agents are using it to move money, it’s time to map the attack surface.