Add authenticated Rust machine-funding server

[ameya-deshmukh]

Summary

• add a standalone Rust machine-funding server for exact SUSDC and native-gas funding
• add a dedicated machine-operator role to the faucet contract without changing public drip behavior
• persist signed transactions before broadcast and serialize one nonce queue across both assets
• enforce permanent idempotency, receipt-confirmed success, recipient/global budgets, and deterministic retry behavior
• isolate the signer under a dedicated Unix user and crash-durable Unix-socket Redis
• expose the internal routes through TLS with an orchestration-staging egress allowlist

Deployment

• deploy and seed the updated non-proxy faucet contract
• configure the dedicated machine operator address during deployment
• build the release binary, create the private 0600 environment file, and install the committed Redis, Supervisor, tmpfiles, and Nginx configuration through explicit SSH commands
• point the mock-provider client at https://faucet.seismictest.net

No Linear issue exists for this work.

API

• POST /api/internal/transfers
• POST /api/internal/gas
• GET /api/internal/health
• GET /api/internal/readiness (authenticated)

Test plan

• Rust format and clippy with warnings denied
• 18 Rust tests covering HTTP auth/wire behavior, Redis concurrency/durability/leases, transaction signing, retries, receipts, and budgets
• release build
• frozen Bun installs, typechecks, and production builds for both public frontends
• ABI drift validation against the fresh contract artifact
• Foundry format/build and 27 contract tests
• Supervisor launcher shell syntax

[ameya-deshmukh]

Superseded by the smaller stacked PRs:

1. Add bounded machine funding contract role #39 — contract capability
2. Bootstrap the machine funding Rust workspace #38 — Rust workspace and lockfile
3. Add the authenticated machine funding server #41 — authenticated server
4. Configure staging machine funding deployment #40 — staging deployment

The tip of #40 is tree-identical to this PR.