feat: add seeded snapshots, backups, secret rotation and CD

[thegreatfeez]

• deterministic seed dataset with local IPFS, raw-event export and anonymised snapshots
• checksummed backups, restore script and post-restore chain reconciliation
• env/file/Vault secret loading with hot rotation and JWT grace
• digest-pinned CD with migration lint and post-deploy checks

closes #147
closes #146
closes #145
closes #144

What this does

Checklist

• npm run check:contracts, npm run build and npm test pass
• Schema changes come with a new, forward-only migration (existing migrations untouched)
• No secrets: no .env files, keys, seeds or tokens, in code, tests, fixtures or logs
• Anything that can submit a transaction still defaults to dry-run
• docs/api.md updated if a request or response shape changed
• .env.example updated if config changed

How this was tested

[github-actions]

👋 Thanks for the contribution! This repository only accepts contributor pull requests into the develop branch. PRs raised against main cannot be merged, so this one has been closed automatically.

Please re-open your PR with base: develop (rebase your branch onto develop first if needed). See the note at the bottom of the issue you're working on.