feat(antilopay): inject apay-tag meta on cabinet boot

Pairs with the bedolaga-bot commit that exposes
GET /cabinet/public/site-verification (JSON: { apay_tag: string | null }).

New useSiteVerification hook fires once on App mount, fetches the
configured tag value, and upserts <meta name='apay-tag' content='...'>
into document.head. When the bot returns null we proactively remove
any previously-rendered tag so toggling the env var off cleans up the
page.

Failure modes are silent — verification is best-effort and must
never block the cabinet from rendering. No admin UI field is needed:
the value lives in the bot's .env (ANTILOPAY_APAY_VERIFICATION_TAG),
matching how all other Antilopay credentials are configured.

src/hooks/useSiteVerification.ts

@@ -0,0 +1,56 @@
+import { useEffect } from 'react';
+import { siteVerificationApi } from '../api/siteVerification';
+
+/**
+ * Fetches the configured site-verification tokens from the bot backend
+ * and injects the matching `<meta>` tags into `document.head`.
+ *
+ * Used by Antilopay's verification flow (lk.antilopay.com → Проект →
+ * Верификация → Способ 1: мета-тег). Once the merchant copies the
+ * Antilopay-provided value into `ANTILOPAY_APAY_VERIFICATION_TAG`,
+ * the cabinet will start rendering `<meta name="apay-tag" content="...">`
+ * automatically — no rebuild required.
+ *
+ * The hook is no-op on backend errors (verification is a best-effort
+ * concern and must never block the cabinet from rendering).
+ */
+export function useSiteVerification(): void {
+  useEffect(() => {
+    let cancelled = false;
+
+    siteVerificationApi
+      .get()
+      .then((data) => {
+        if (cancelled) return;
+        if (data.apay_tag) {
+          upsertMetaTag('apay-tag', data.apay_tag);
+        } else {
+          removeMetaTag('apay-tag');
+        }
+      })
+      .catch(() => {
+        // Silent fail — verification meta is best-effort, doesn't block UI.
+      });
+
+    return () => {
+      cancelled = true;
+    };
+  }, []);
+}
+
+function upsertMetaTag(name: string, content: string): void {
+  let tag = document.head.querySelector<HTMLMetaElement>(`meta[name="${name}"]`);
+  if (!tag) {
+    tag = document.createElement('meta');
+    tag.setAttribute('name', name);
+    document.head.appendChild(tag);
+  }
+  tag.setAttribute('content', content);
+}
+
+function removeMetaTag(name: string): void {
+  const tag = document.head.querySelector<HTMLMetaElement>(`meta[name="${name}"]`);
+  if (tag) {
+    tag.remove();
+  }
+}