feat(pusher): add validated onion delegation for v2 pings

- Load WELIST_PING_DELEGATION_FILE into a typed OnionDelegation
- Send the certificate only with v2 pings for onion hosts
- Validate the onion host, expiry and delegated key against
  BAL_SERVER_URL and SSL_KEY_PATH at startup; disable delegation
  with a warning on any mismatch
- Stop sending unsigned info/base_fee/version with v1 pings so
  v1 remains liveness-only
- Document v1/v2 metadata handling and onion delegation implications
- Add contrib/make_onion_delegation.py to issue certificates offline,
  with Ed25519 key validation and clean CLI error handling

bal-pusher.sh

@@ -27,9 +27,12 @@ export BAL_PUSHER_REGTEST_ZMQ_HASHBLOCK=tcp://127.0.0.1:21332
 export BAL_PUSHER_SEND_STATS=true
 export WELIST_SERVER_URL=http://localhost:8086
 export WELIST_SKIP_URL_VALIDATION=true
-# Sign WeTime pings with the v2 canonical JSON scheme (DNSSEC/onion public key
-# discovery). Remove this line to fall back to the legacy v1 signature.
-export WELIST_PING_SIG_VERSION=2
+# Local development uses the legacy v1 signature, verified by the service
+# against GET /.pub_key.pem: a localhost URL cannot use DNSSEC key discovery.
+# v2 requires a public DNS hostname (or a v3 onion URL) with a published key.
+# The WeTime service must run with WELIST_ALLOW_LEGACY_PING=true and, for
+# loopback addresses, WELIST_ALLOW_LOCALHOST_PING=true.
+export WELIST_PING_SIG_VERSION=1
 export BAL_SERVER_URL="http://127.0.0.1:9133"
 export SSL_KEY_PATH="$WORKING_DIR/private_key.pem"