fix(indexer): derive SR-2 time from consensus

[randomblocker]

What changed

• replace producer-controlled transaction timestamps with the consensus timestamp of the confirmed block containing the exact StorageProgram write
• require confirmed status, storage transaction type, exact envelope/write target, whole-content hash equality, confirmed block status, and transaction membership in that block
• cache block lookups and retain the earliest matching consensus observation for the current content hash
• clear previously persisted unsafe anchor_time values once, so reputation safely falls back to finalisedAt until corrected evidence is available
• add a bounded, wall-clock-limited, resumable transaction-history backfill for unresolved DACS-5 bundle rows
• reset an anchor when the same locator's content changes, preventing overwritten storage from inheriting an earlier content's time

Why

Issue #30 identified that tx.timestamp is producer supplied and that a failed or unrelated transaction could previously backdate a locator merely by mentioning it. The live node exposes confirmed block timestamps and ordered transaction membership, allowing the indexer to attribute time to the exact content-producing write instead.

Impact

DACS-5 reputation uses the sr2-anchor-timestamp window only when a bundle has a content-bound consensus observation. Unresolved bundles retain the existing honest finalisedAt fallback. Historical records converge through bounded passes without allowing an unresolvable row to starve later work.

Validation

• npm test — 152 passed
• npm run typecheck
• npm run build
• regression coverage for failed/unrelated references, confirmed block membership/time, bounded cursor resumption, content-overwrite invalidation, earliest-time retention, chain reset, and one-time unsafe-value migration

Coordination

PR #71 also touches scanner/reindex state. It is independently ready and should land first; this PR can then be rebased to resolve the mechanical overlap without mixing scopes.

Closes #30