Authorize the backend signer as a contract writer

[trietlu]

Description

Provide a script + runbook to call setAuthorizedWriter(backendSigner, true) on each deployed contract. Per D5: production uses a separate hot writer key (CHAIN_PRIVATE_KEY) authorized by the cold owner key; staging may reuse the deployer key.

Affected areas

contracts/scripts/, docs/.

Dependencies / order

Depends on #4.

Acceptance criteria

• A script authorizes the backend signer on a target network; documented.
• On staging, the backend signer successfully anchors; an unauthorized key reverts with Unauthorized.
• Owner can revoke a writer (setAuthorizedWriter(writer, false)), verified.

Definition of done

• Implemented on a short-lived feature branch, merged into staging (never main).
• Verified on the staging preview stack.
• Docs updated if infra/env/API behavior changes.