[Kaylahray]

Closes #509

Summary

• Type the token issuer as Address in record_payment (Asset enum), Asset::Token, and the allowlist key so a garbage string cannot be allowlisted or written on-chain.
• Represent native XLM as Asset::Native instead of an empty issuer field; reject "XLM" on Asset::Token.
• Add schema V6: rewrite existing PaymentRecord / history / allowlist entries from String issuer to Address (chunked via IssuerMigrationIncomplete, sequenced after upgrade()). Dual-read uses raw Val + try_from_val so pre-V6 records do not trap.
• Version the event path for the new encoding: allowlist events carry Address; InvoicePaymentRecorded stays schema 2 (compact). The TypeScript decoder still accepts schema 1 (string issuer, full payload) for the migration period.
• Align schema.json, ops scripts, Makefile, error manifest (IssuerMigrationIncomplete = 23), and the ABI drift check.

Test

• cargo test -p invoice-payment (includes malformed issuer, canonical Address allowlist key, native-with-no-issuer-field, V5→V6 rewrite)
• node soroban/scripts/check-client-drift.mjs — 23 errors, 18 methods match schema.json
• cd soroban/client && npm test (after npm install)
• Confirm ./invoke-record-payment.sh uses --asset Native / --asset '{"Token":["USDC","G..."]}'
• Pause → upgrade() → repeated upgrade_storage() until storage_schema_version is 6 → unpause (runbook)
• [ ]

Backend is intentionally unchanged in this PR.