Hardhat network config + repeatable per-chain deploy/verify

[trietlu]

Description

Add baseSepolia (84532) and baseMainnet (8453) networks to hardhat.config.js, sourcing RPC URL + deployer key from env (no secrets committed). Parameterize deploy.js to emit/persist the deployed address per network. Add Basescan verification. Write a deploy runbook. Key model per D5: staging may use one deployer+writer key; production deploys with a cold owner key.

Affected areas

contracts/hardhat.config.js, contracts/scripts/deploy.js, docs/.

Dependencies / order

Depends on #3.

Acceptance criteria

• npx hardhat run scripts/deploy.js --network baseSepolia deploys and prints the address; same for baseMainnet.
• Deployed addresses recorded in a tracked location (e.g. deployments/ or the plan doc).
• Basescan verification documented and reproducible.
• No private keys or RPC secrets committed.

Definition of done

• Implemented on a short-lived feature branch, merged into staging (never main).
• Verified on the staging preview stack.
• Docs updated if infra/env/API behavior changes.