feat(archiver): bind the API before the source handshake; wire fallback RPC URLs

[DylanVerstraete]

Fifth PR of the archiver liveness audit (finding 8). Stacked on #1347 → #1346 → #1345 → #1344; retarget to usc-dev as those merge.

Changes

• API up before any network handshake. The HTTP API and the health tracker bind right after the sled store opens, ahead of the ws/http/Creditcoin handshake, the canonical-anchor check and --backfill (which can run for hours). Probes and /roots* readers see the process the whole time. /ready answers 503 with source chain handshake not complete until the source identity is verified and pinned; chain_id and finalization_lag in /status are null until then (Health::set_source, OnceLock, second call ignored).
• --rpc-fallback-urls (RPC_FALLBACK_URLS, comma-separated) feeds eth::Client::new_with_fallbacks on every dial: startup ws/http, backfill, reconnect. Block fetches then walk [primary, fallbacks…] on "not found" / transport errors, as the proof-gen server already does. If any fallback is unreachable (or on another chain) at dial time the archiver warns and continues with the primary alone, so a dead backup can never block startup or recovery.
• Docs: the README and flag help no longer claim blocks are fetched over HTTP. The WS client carries both the newHeads subscription and the block/receipt fetches; the HTTP endpoint is used for head tracking and the anchor check.

Verification

• cargo test -p archiver -p continuity (36 archiver tests, 1 new: not ready before the handshake even with a fresh head, ready after set_source, second set_source ignored), clippy -D warnings, fmt.
• Fake RPC whose WS eth_chainId takes 20 s: during the handshake /status → 200 {chain_id: null, ready: false, not_ready_reasons: ["source chain handshake not complete", "source head never observed"]}, /ready → 503, /roots/latest → {"latest_block": null}.
• reth --dev with --rpc-fallback-urls http://127.0.0.1:1,http://127.0.0.1:18845: dial with fallback RPCs failed, retrying with the primary only: Failed to connect to fallback RPC URL #0 …, then starting archiver and normal archiving. With only the live fallback: starts cleanly, anchor check passes.

[cursor]

PR Summary

Medium Risk
Changes startup ordering and readiness semantics operators rely on, and adds multi-endpoint RPC dialing with timeout/retry behavior on every connect path.

Overview
Starts the HTTP API immediately after opening the sled store, before WS/HTTP/Creditcoin handshake, canonical anchor, or --backfill, so /status and /roots* stay reachable during long startup. /ready stays 503 with source chain handshake not complete until chain identity is pinned and finalization lag is known; chain_id and finalization_lag in /status are null until then via Health::set_source and a one-time OnceLock.

Adds --rpc-fallback-urls / RPC_FALLBACK_URLS: a shared dial() helper (with rpc-timeout-secs) uses fallback RPCs on startup, backfill, and reconnect; if fallback dial fails, it warns and retries primary only so bad backups cannot block startup. README/flag help now state blocks/receipts load on WebSocket (with fallbacks on not-found/transport errors); HTTP is for head tracking and anchor checks.

^{Reviewed by Cursor Bugbot for commit 407204c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 19ddb4e. Configure here.}