Merchant Controls & Recipient Pinning

Allowlisted service providers, pinned settlement recipients, and domain-level blocklists.