Add dAuth job secret endpoints

[aledefra]

Summary

• Add /add_secrets for full job secret bundle writes from signed protocol-oracle requests.
• Add /get_secrets for R1FS-authorized job runners.
• Require signed hex-millisecond timestamp nonces no older than 120 seconds on both endpoints.
• Echo the request nonce in signed success and error responses.
• Encrypt GET bundles to the signed requester and return only encrypted_secret_bundle.
• Keep the single write shape {job_id, job_secrets} and overwrite semantics.
• Route DAUTH_JOB_SECRETS writes only to dAuth registry peers, excluding default/configured ChainStore peers.
• Refresh the DAUTH_JOB_SECRETS replica every 10 minutes through the same dAuth-only peer set.
• Refresh dAuth registry authorization and replication peers every hour through Core lifecycle predicates, without request-path RPC calls.
• Fail closed on registry errors and retry failed reads after 60 seconds.
• Pause removed dAuth servers, clear revoked peer caches, and restore readiness only after a resumed Uvicorn process reports startup.

Stack

• Base: develop.
• Hide Deeploy mandatory secrets in dAuth #468 is stacked on this PR; Persist and resolve dAuth job secrets #471 is stacked on Hide Deeploy mandatory secrets in dAuth #468.
• All three branches were rebased and pushed bottom-up after this change.

Security Model

Timestamp nonces provide a stateless 120-second freshness bound, not strict one-time use. Strict prevention of replay inside that window would require consumed-nonce state or monotonic counters.

Successful registry reads are cached for one hour. Registry failures fail closed and retry after one minute. Registry reads are synchronous and rely on the SDK Web3 provider to return or time out.

Explicit peers restrict outbound ChainStore routing only. Core currently does not authorize inbound operations by hash namespace, so inbound DAUTH_JOB_SECRETS ACLs or a dedicated authenticated replication protocol remain required hardening. Core hsync also accepts the first valid snapshot without freshness arbitration, so version-aware merge semantics remain a follow-up.

Open Questions

• Decide later whether partial merge/update semantics are needed.
• Delete endpoints remain out of scope.
• Add inbound namespace authorization and version-aware hsync before treating ChainStore replication as a complete security boundary.

Tests

• PR Add dAuth job secret endpoints #458 dAuth discovery: 34 passed.
• Python compile and diff checks: passed.
• Top-stack dAuth/Deeploy discovery could not be rerun in this local environment because the available Python runtimes lack the complete sibling SDK/Core dependency set (eth_account in system Python and requests in the bundled runtime). The rebases were conflict-free, top-stack Python compilation passed, and all three worktrees are clean against their remotes.
• Core pause-hook tests could not import for the same dependency reason.