feat(antilopay): inject apay-tag meta on cabinet boot

Pairs with the bedolaga-bot commit that exposes
GET /cabinet/public/site-verification (JSON: { apay_tag: string | null }).

New useSiteVerification hook fires once on App mount, fetches the
configured tag value, and upserts <meta name='apay-tag' content='...'>
into document.head. When the bot returns null we proactively remove
any previously-rendered tag so toggling the env var off cleans up the
page.

Failure modes are silent — verification is best-effort and must
never block the cabinet from rendering. No admin UI field is needed:
the value lives in the bot's .env (ANTILOPAY_APAY_VERIFICATION_TAG),
matching how all other Antilopay credentials are configured.

src/api/siteVerification.ts

@@ -0,0 +1,16 @@
+import { apiClient } from './client';
+
+export interface SiteVerification {
+  apay_tag: string | null;
+}
+
+/**
+ * Public, unauthenticated endpoint — payment-provider crawlers (Antilopay)
+ * need to be able to read these values to validate site ownership.
+ */
+export const siteVerificationApi = {
+  async get(): Promise<SiteVerification> {
+    const { data } = await apiClient.get<SiteVerification>('/cabinet/public/site-verification');
+    return data;
+  },
+};