feat(alpha): complete hardening backlog

Complete the alpha-hardening Ralph task set, including tracker billing/accounting guards, validator fraud-audit primitives, wallet binding proof support, documentation runbooks, and updated tests.

Verification: .venv/bin/python -m compileall -q packages tests; .venv/bin/python -m pytest -q --tb=short (313 passed, 3 skipped, 1 failed: tests/test_mining_cli.py::test_legacy_start_without_port_uses_next_available_port because meshnet-node pid 1263451 is already listening on port 7000).

docs/dev/test-env.md

@@ -0,0 +1,60 @@
+# Test environment
+
+## Setup
+
+Create a venv at the repo root and install the root dev extras plus the
+packages exercised by the tests you're running:
+
+```bash
+# Linux/macOS
+python3 -m venv .venv
+.venv/bin/pip install -e ".[dev]"
+.venv/bin/pip install -e packages/node -e packages/tracker -e packages/gateway
+```
+
+```powershell
+# Windows (native, no WSL)
+python -m venv .venv
+.venv\Scripts\python.exe -m pip install -e ".[dev]"
+.venv\Scripts\python.exe -m pip install -e packages\node -e packages\tracker -e packages\gateway
+```
+
+`conftest.py` at the repo root adds every `packages/*` source directory to
+`sys.path`, so tests can `import meshnet_node`, `import meshnet_tracker`, etc.
+without an editable install. That only resolves first-party modules, though —
+each package's own third-party dependencies (e.g. `cryptography` for
+`meshnet_node.wallet` and `meshnet_tracker.wallet_proof`) still need to be
+installed in the venv, either via `pip install -e packages/<pkg>` or by
+depending on the root `dev` extra covering them.
+
+`cryptography>=41` is declared in `packages/node/pyproject.toml` (and
+`packages/p2p/pyproject.toml`) and is also pulled in by the root `dev` extra,
+so `pip install -e ".[dev]"` alone is enough to run the wallet-related tests
+even without installing `packages/node`.
+
+## Running tests
+
+```bash
+.venv/bin/python -m pytest
+```
+
+## Optional-dependency tests
+
+Some tests import heavyweight or optional third-party packages and guard
+themselves with `pytest.importorskip(...)` — they skip cleanly if the
+dependency isn't installed:
+
+- `tests/test_real_model_backend.py` — `torch`, `transformers`, `safetensors`,
+  `accelerate`, `bitsandbytes`
+- `tests/test_devnet_treasury.py` — `solders`, `spl.token.instructions`
+
+`tests/test_openai_gateway.py` is the exception: it imports `openai` and
+`langchain_openai` directly inside test functions with no `importorskip`
+guard, so it hard-fails if those aren't installed. They're included in the
+root `dev` extra, so a normal `pip install -e ".[dev]"` covers it. If you
+deliberately install a minimal environment without the `dev` extra, skip it
+explicitly:
+
+```bash
+.venv/bin/python -m pytest --ignore=tests/test_openai_gateway.py
+```