Add private recovery API for validated inputs

[huitseeker]

Summary

After #2393, validators store transaction inputs under a Golden threshold key. The demo also needs a private way to find these records and ask each validator for a decryption share.

Operators can now start an optional HTTP admin service on a separate listener. GET /admin/transactions returns all stored records as hex-encoded JSON in insertion order. Each entry includes the transaction ID, encrypted inputs, nonce, encrypted content key, and decryption context.

POST /admin/decryption-share accepts an encrypted content key and its decryption context. It returns this validator's hex-encoded Golden share.

The public validator service does not receive the Golden secret share. The admin service has no caller authentication, so operators must control access to its port. A later TEE flow will add caller checks and a share release policy.

Tests recover one validator's stored TransactionInputs with shares from two other validators in the same Golden setup. Recovery tools receive the public Golden setup through deployment configuration.

Changelog

[[entry]]
scope = "validator"
impact = "added"
description = "Operators can list stored private inputs and issue Golden decryption shares through a private admin API."

[igamigo]

Not the most in-depth review for now, but leaving some comments

[kkovaacs]

I assume this is a temporary feature just for the demo, right?

In that context this looks good to me.

[Mirko-von-Leipzig]

Why are we adding back ROWID?

[huitseeker]

The admin API needs stable insertion order. The frontend reverses that order to show the newest records first. The insertion sequence is rowid backed, and the schema now states why.

[Mirko-von-Leipzig]

@kkovaacs is there some sort of standard for this?

[kkovaacs]

@kkovaacs is there some sort of standard for this?

Not really. We do have a standard log line that is logged when starting up a service, but this is just an additional API that is exposed by the validator service.