Stabilize weights endpoint and coldkey map ops

[wallscaler]

Summary

• serve stale-good signed weights at the Cloudflare edge for /v1/validator/weights/next
• fail startup on invalid service roles and missing submit CNF token secrets
• make PM read hard cap an actual hard cap
• expose submit metrics on the submit role behind admin auth
• add scripts/refresh_coldkey_map.py to refresh/check SN39 hotkey-to-coldkey mappings

Verification

• publisher_verify.py: PASS 160/160
• weights_verify.py: PASS 32/32
• assigned_lane_verify.py: PASS 15/15
• node deploy/edge-router/worker.test.mjs: pass
• local coldkey refresh smoke: pass

Live note

• Cloudflare edge worker was deployed manually; /v1/validator/weights/next now returns 200 from edge cache during read-origin stalls.
• Production coldkey refresh still requires valid Railway/prod DB access.