feat(tracker): unified auth boundary — gossip HMAC + validator token + admin-gated reads (alpha 01/02/20, ADR-0017)

Wire server.py handlers to the auth helper: forfeit requires validator
service token or admin session (client API keys rejected); billing summary/
settlements/registry-wallets and benchmark endpoints require admin/service;
the three gossip mutation endpoints require a fresh hive HMAC signature and
outgoing gossip pushes are signed. Dashboard sends its session token on
panel fetches. Existing tests updated for the new gates.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.scratch/alpha-hardening/issues/01-c1-gossip-auth.md

@@ -1,4 +1,4 @@
-Status: ready-for-agent
+Status: done
 
 # 01 — C1: Authenticate hive gossip endpoints
 

.scratch/alpha-hardening/issues/02-a2-unified-auth-boundary.md

@@ -1,4 +1,4 @@
-Status: ready-for-agent
+Status: done
 
 # 02 — A2: Unified auth boundary for privileged and financial reads
 

.scratch/alpha-hardening/issues/20-validator-service-token.md

@@ -1,4 +1,4 @@
-Status: ready-for-agent
+Status: done
 
 # 20 — Validator service token for `/v1/billing/forfeit`