feat(prom): watch every signing wallet's balance on the chain it spends on

[DylanVerstraete]

Third of the observability trio (with #53): the most standard relayer metric there is, and we had no view of it.

Problem

Every tx-sending role runs off a plain EOA that only needs gas — delivery on the destination chain, ack and claim submission on the Creditcoin chain. When a wallet runs dry, sends fail with whatever wording that node gives an underfunded sender, which at a glance reads like an RPC problem. Nothing pointed at the wallet. Hyperlane (hyperlane_wallet_balance) and OpenZeppelin Defender both treat this as a headline metric.

Change

New balance worker publishing relayer_signer_balance_ether{chain_key, role, address}, polled every 60s.

• Watch list derived from config, each role on the chain it actually spends gas on: delivery → the route's destination RPC; ack/claim → the Creditcoin RPC. Watching the right address on the wrong chain would report a healthy balance for a wallet that is empty where it matters — a test pins this mapping.
• address is a label, so one wallet reused across roles/chains stays correlatable in queries.
• Providers are built lazily and dropped on a failed read (re-dial next tick, never retry a dead socket forever).
• An unparseable signer_key is skipped with a warning, not an error — the worker that uses the key raises the real failure with context, and the relayer must not refuse to start over its least important worker.
• Health is heartbeated per completed sweep even if every read failed: an unreachable RPC already starves the indexing workers' success-only heartbeats and trips the liveness restart; this auxiliary worker should not be a second finger on that trigger.

Alert this enables

relayer_signer_balance_ether < 0.1

warning while there is still time to top up, instead of when deliveries are already failing. Units are ether (Hyperlane convention) so thresholds are human; the encode test pins metric name, labels and units so a rename or wei/ether mixup fails in CI rather than in a silently never-firing alert.

Verification

• cargo test --workspace — 169 pass, 0 fail (3 new: role→chain mapping, bad-key skip, encode shape).
• clippy -D warnings clean, fmt clean.

[cursor]

PR Summary

Low Risk
Observability-only background worker with defensive health and startup behavior; no changes to delivery, ack, or claim transaction paths.

Overview
Adds a signer balance watcher so operators can alert before gas wallets run dry (instead of misreading underfunded-send failures as RPC issues).

A new balance worker runs alongside existing relayer tasks: it builds a watch list from route config (delivery on each route’s destination RPC; ack / claim on the Creditcoin RPC), polls balances every 60s, and publishes relayer_signer_balance_ether with labels chain_key, role, and address (ether units for simple thresholds like < 0.1). Unparseable keys are skipped with a warning so startup isn’t blocked; with no signers configured the worker stays idle and does not register with /health (avoids liveness restart loops). RPC providers are recreated after failed reads; health heartbeats once per sweep even when reads fail, so this auxiliary path doesn’t amplify restart storms from unreachable RPCs.

Prometheus wiring extends MetricsTrait / RelayerMetrics with set_signer_balance; tests pin role→chain mapping, idle health behavior, bad-key handling, and the encoded metric shape.

^{Reviewed by Cursor Bugbot for commit f59c6f1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f7fa2f5. Configure here.}