Add contract-driven repo reconciler

[LandynDev]

Part of repo-registration phase 2a (task 2a-8). Supersedes gittensor #1653's validator-side reconciler; the mirror now syncs itself from the on-chain registry.

What it does

• New registry/ package: cron job (default every 10 min) reads the repos-v0 contract's ACTIVE repo set via raw childstate JSON-RPC (no substrate dependency added), pinned to one finalized block hash per pass
• Diff against tracked repos: id-first matching with name fallback + id binding; registered-but-untracked repos pass the GitHub App-install gate, then get registered + a 40-day deep backfill (gating/backfill ported from #1653); repos absent from the registry are untracked (Deregistered/Pruned semantics)
• Renames handled by stable github_repo_id; installation webhook now captures the numeric id
• Safety: paused contract or any RPC/decode error aborts the pass with zero writes; empty-registry result suppresses mass-untrack (treated as likely misconfig)
• Add admin repo list and deregister endpoints #226 admin endpoints demoted to manual-ops escape hatch (behavior unchanged); no MIRROR_ADMIN_API_KEY external write path
• Schema: additive nullable github_repo_id BIGINT on repos (existing deployments: ALTER TABLE repos ADD COLUMN github_repo_id BIGINT; — noted in 01_repos.sql)

Key derivation

Codec implemented in-repo (blake2b, xxhash, SCALE, ss58) with zero new npm deps; root-key derivation cross-verified by reproducing issues-v0's known production key 52789899, giving RepoRegistry::repos = cb55726b. Test vectors generated from independent reference implementations.

Config: REGISTRY_RPC_URL, REGISTRY_CONTRACT_ADDRESS, REGISTRY_RECONCILE_ENABLED/CRON, REGISTRY_BACKFILL_DAYS.

Tests: 57/57 (32 new: codec vectors, decode, reconcile-plan edges); eslint clean; nest build passes.