security: verify BFT PRE-PREPARE messages before accept

[createkr]

Summary

This change closes an authentication gap in the BFT consensus receive path by verifying PRE-PREPARE message signatures and rejecting stale messages before proposal handling continues.

What changed

• Added HMAC signature verification in _handle_pre_prepare()
• Added timestamp freshness enforcement using the existing CONSENSUS_MESSAGE_TTL window
• Kept PRE-PREPARE validation behavior consistent with the existing PREPARE and COMMIT handlers

Why

PREPARE and COMMIT were already authenticated on receipt, but PRE-PREPARE was not. That left the proposal-carrying message type outside the normal verification path and allowed forged or stale PRE-PREPARE messages to reach downstream consensus logic.

Scope

• node/rustchain_bft_consensus.py only

Closes #2061

Payout Wallet

RTC1d48d848a5aa5ecf2c5f01aa5fb64837daaf2f35

[Scottcjn]

Merged. 75 RTC. Real vulnerability — _handle_pre_prepare was skipping signature verification that _handle_prepare had. Nice catch.