feat(tracker): unified auth boundary — gossip HMAC + validator token + admin-gated reads (alpha 01/02/20, ADR-0017)

Wire server.py handlers to the auth helper: forfeit requires validator
service token or admin session (client API keys rejected); billing summary/
settlements/registry-wallets and benchmark endpoints require admin/service;
the three gossip mutation endpoints require a fresh hive HMAC signature and
outgoing gossip pushes are signed. Dashboard sends its session token on
panel fetches. Existing tests updated for the new gates.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/test_manual_route_benchmark.py

@@ -41,6 +41,7 @@ def benchmark_setup(tmp_path):
             }
         },
         benchmark_results_path=results_path,
+        validator_service_token="bench",
     )
     port = tracker.start()
     tracker_url = f"http://127.0.0.1:{port}"