Add siteSignMessage so proving xite ownership never exposes the key

[MudDev]

Adds a way to prove control of a xite's address without the private key ever becoming a command argument.

Why

EpixSites is gaining ownership claims: a xite owner proves they hold the address's key by signing a challenge, and the directory verifies it with ecdsaVerify. The only way to produce that signature today is

epix-server siteCmd <address> ecdsaSign '["<challenge>", "<private key>"]'

which writes the key into shell history and exposes it through ps for as long as the process runs. That is not an acceptable way to ask someone for their key.

What this adds

siteSignMessage signs an arbitrary message with the bound xite's own private key and returns only the signature.

CLI: epix-server siteSignMessage <address> [message]. The key is resolved in the order that keeps it out of reach:

1. A running node signs with the key it already holds, so an owner running their own node types no key at all.
2. Otherwise the key stored in this data dir.
3. Otherwise the command asks for it on stdin, with terminal echo off (restored afterwards, and it degrades to a visible read when stdin is not a terminal).

The key is never read from an argument in any of those paths, so nothing lands in shell history and nothing shows up in ps.

The websocket command is admin gated. Signing as the xite is the same authority that signs its content, so an ordinary page must never be able to ask for it. ecdsaSign is unchanged and still signs with the user's auth key, which is a different key and a different trust level.

Testing

Against a scratch node:

• Stored key, node running: signs over the admin socket, no prompt.
• Stored key, node down, stdin closed: signs from the data dir's stored key, no prompt (a prompt would have failed).
• No stored key: prompts, accepts the pasted key, and prints a signature that verifies against the address.
• Unknown xite with a stored key absent: reports No stored private key for this xite on this node rather than signing.

cargo test -p epix-ui -p epix-server passes (353 + 5).

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud