feat(alpha): complete hardening backlog

Complete the alpha-hardening Ralph task set, including tracker billing/accounting guards, validator fraud-audit primitives, wallet binding proof support, documentation runbooks, and updated tests.

Verification: .venv/bin/python -m compileall -q packages tests; .venv/bin/python -m pytest -q --tb=short (313 passed, 3 skipped, 1 failed: tests/test_mining_cli.py::test_legacy_start_without_port_uses_next_available_port because meshnet-node pid 1263451 is already listening on port 7000).

tests/test_devnet_treasury.py

@@ -13,9 +13,24 @@ import urllib.error
 import urllib.request
 
 import pytest
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
 
 from meshnet_tracker.billing import BillingLedger
 from meshnet_tracker.server import TrackerServer
+from meshnet_tracker.wallet_proof import binding_message
+
+
+def _keypair():
+    """Deterministic-enough local ed25519 keypair + base58 address for tests."""
+    priv = Ed25519PrivateKey.generate()
+    from meshnet_node.wallet import _b58encode
+
+    public = priv.public_key().public_bytes_raw()
+    return priv, _b58encode(public)
+
+
+def _sign(priv: Ed25519PrivateKey, api_key: str, wallet: str) -> str:
+    return priv.sign(binding_message(api_key, wallet)).hex()
 
 
 class _FakeDeposit:
@@ -78,14 +93,15 @@ def test_wallet_register_requires_auth(watched_tracker):
 
 def test_deposit_credits_bound_api_key_exactly_once(watched_tracker):
     tracker_url, ledger, treasury = watched_tracker
+    priv, wallet = _keypair()
     reply = _post_json(
         f"{tracker_url}/v1/wallet/register",
-        {"wallet": "So1anaWa11et111"},
+        {"wallet": wallet, "signature": _sign(priv, "client-key-1", wallet)},
         headers={"Authorization": "Bearer client-key-1"},
     )
     assert reply["bound"] is True
 
-    treasury.deposits.append(_FakeDeposit("sig-1", "So1anaWa11et111", 25.0))
+    treasury.deposits.append(_FakeDeposit("sig-1", wallet, 25.0))
     assert _wait_for(lambda: ledger.get_client_balance("client-key-1") > 0)
     assert ledger.get_client_balance("client-key-1") == pytest.approx(25.0)