feat(alpha): complete hardening backlog

Complete the alpha-hardening Ralph task set, including tracker billing/accounting guards, validator fraud-audit primitives, wallet binding proof support, documentation runbooks, and updated tests.

Verification: .venv/bin/python -m compileall -q packages tests; .venv/bin/python -m pytest -q --tb=short (313 passed, 3 skipped, 1 failed: tests/test_mining_cli.py::test_legacy_start_without_port_uses_next_available_port because meshnet-node pid 1263451 is already listening on port 7000).

packages/tracker/meshnet_tracker/cli.py

@@ -49,11 +49,20 @@ def main() -> None:
             f"(default: {DEFAULT_BILLING_DB_PATH}; ADR-0015)"
         ),
     )
-    common.add_argument(
-        "--no-billing",
-        action="store_true",
-        help="Disable the USDT billing ledger",
-    )
+    common.add_argument(
+        "--no-billing",
+        action="store_true",
+        help="Disable the USDT billing ledger",
+    )
+    common.add_argument(
+        "--max-charge-per-request",
+        type=float,
+        default=None,
+        help=(
+            "Reject chat completion requests whose requested token limit would "
+            "cost more than this many USDT"
+        ),
+    )
     common.add_argument(
         "--accounts-db",
         default=DEFAULT_ACCOUNTS_DB_PATH,
@@ -149,8 +158,9 @@ def main() -> None:
             stats_db=getattr(args, "stats_db", None),
             relay_url=relay_url,
             enable_billing=not args.no_billing,
-            billing_db=None if args.no_billing else args.billing_db,
-            accounts_db=None if args.no_accounts else args.accounts_db,
+            billing_db=None if args.no_billing else args.billing_db,
+            max_charge_per_request=args.max_charge_per_request,
+            accounts_db=None if args.no_accounts else args.accounts_db,
             treasury=treasury,
             settle_period=args.settle_period,
             payout_threshold=args.payout_threshold,