feat(multx): add AWS KMS signer relay and TOTP envelope

[BrewCodeDev]

Summary

• replace mounted validator private keys with non-exportable AWS KMS secp256k1 signing
• use IAM Roles Anywhere through the standard temporary-credential chain
• require HTTPS and file-backed bearer authentication while retaining optional mTLS
• add an isolated optional TOTP envelope service with no signing permission
• add placeholder-only templates, tests, CI image builds, provenance, and immutable digest publication
• update coordinator support and signer security documentation

Security boundary

• signer: kms:GetPublicKey + kms:Sign only
• TOTP runtime: kms:Decrypt only
• TOTP enrollment: kms:Encrypt only
• no permanent AWS credentials, EVM private keys, certificate keys, token values, or production identifiers are committed

Verification

• signer: 9 tests passed; production dependency audit clean
• API: 14 tests passed; production dependency audit clean
• TOTP: RFC 6238 test passed; production dependency audit clean
• Docker builds delegated to CI because the local Docker daemon is unavailable

MultX remains disabled pending independent audit and explicit activation approval.

[github-actions]

Test Results

Package	Passed	Failed	Skipped	Total	Duration
api	no results
indexer	no results
explorer	no results

Coverage

Package	Stmts %	Branch %	Funcs %	Lines %
api	no coverage
indexer	no coverage
explorer	no coverage

_{Generated by ci.yaml for 40bd7f3057a6863bb4262abc68d63288b4798e83. Test JSON + coverage HTML are uploaded as run artifacts.}

[bachal-mb]

Review status: blocked — do not merge as written. The project has confirmed that AWS is not used anywhere, while this PR makes AWS KMS and IAM Roles Anywhere the signing architecture. Please replace it with a provider-neutral/non-AWS signer design and update the runbook, threat model, tests, image workflow, and secret-delivery assumptions accordingly. MultX must remain disabled; no signer or infrastructure migration is approved by this review.

[bachal-mb]

Closing as rejected architecture. The project has confirmed that AWS is not used anywhere, while this branch remains explicitly dependent on AWS KMS/IAM and has not changed since 2026-08-13. Current main already contains the provider-neutral VPS remote-signer/quorum implementation and documentation. Any future signer hardening must extend that non-AWS design in a new reviewed PR. No signer deployment or production configuration change was performed.