feat(rfq): add hardened provider daemon

[tvolk131]

Summary

• add the deadcat-rfq executable with strict init, deposit-address, and run lifecycles
• bind one stable Iroh/provider identity to an encrypted service-owned wallet, an explicit create/open-existing reservation database, and a completion manifest
• probe Elements Core before opening provider state, pin liquidregtest genesis/tip/pegged-asset identity, require completed IBD and synchronized txindex, and securely reload cookie authentication
• refresh authoritative inventory and recover all durable pending signing jobs before advertising readiness
• close transport first and drain accepted commit/signing work on signals, transport failure, bind failure, or readiness-output failure
• document the deliberately non-production regtest_static_v1 profile and the remaining launch work

Safety boundaries

• initialization never overwrites or automatically resumes partial state; the manifest is published last
• normal startup never creates a missing wallet, provider database, identity, or manifest
• state files and credential inputs fail closed on symlinks, wrong ownership, or unsafe Unix permissions
• the wallet passphrase is accepted only through a bounded owner-only file and is zeroized after wallet open
• provider storage is atomically published without clobbering, requires working file locks, and verifies schema/provider identity on reopen
• Core 23.3.3 does not expose a custom -feeasset override through RPC, so this first profile explicitly forbids that operator setting and remains regtest-only

Verification

• cargo fmt --all -- --check
• cargo clippy --locked --offline --workspace --all-targets -- -D warnings
• cargo test --locked --offline --workspace --all-targets -- --test-threads=1
• cargo test --locked --offline --workspace --doc
• ignored live Elements source test run against pinned Elements 23.3.3

Stack

This PR is intentionally based on #36 and contains exactly one additional commit. Once #36 merges, this PR can be retargeted to master.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}