feat(pusher): add validated onion delegation for v2 pings

- Load WELIST_PING_DELEGATION_FILE into a typed OnionDelegation
- Send the certificate only with v2 pings for onion hosts
- Validate the onion host, expiry and delegated key against
  BAL_SERVER_URL and SSL_KEY_PATH at startup; disable delegation
  with a warning on any mismatch
- Stop sending unsigned info/base_fee/version with v1 pings so
  v1 remains liveness-only
- Document v1/v2 metadata handling and onion delegation implications
- Add contrib/make_onion_delegation.py to issue certificates offline,
  with Ed25519 key validation and clean CLI error handling

.env.example

@@ -55,6 +55,9 @@ WELIST_SERVER_URL=https://welist.bitcoin-after.life
 # validated `_welist-key.<host>` TXT record (or a v3 onion address). Omit or
 # set to 1 for the legacy scheme.
 WELIST_PING_SIG_VERSION=2
+# Onion hosts only: delegation certificate issued offline by the onion identity
+# key. SSL_KEY_PATH is then the dedicated ping key, not the identity key.
+# WELIST_PING_DELEGATION_FILE=/var/bal/onion-delegation.json
 
 # ZMQ endpoints per network (default: localhost only)
 BAL_PUSHER_BITCOIN_ZMQ_HASHBLOCK=tcp://127.0.0.1:28332