feat: let the sync operator set an outage traffic allowance

[timwu20]

Implements the FR-3 outage handling agreed on 2026-10-05 (design: ChainSafe/canton-extending-mainnet#142), in place of #61 and #66. Closes ChainSafe/canton-extending-mainnet#129.

During a global-synchronizer outage, the operator sets outage-traffic-allowance (a positive number of bytes) in the sync operator app's config and restarts the app, following the runbook. Once the global synchronizer is back, the operator removes it and restarts again. Nothing detects the outage, and there is no Daml change.

• On start, the app sets the limit of every member with a purchase on record to exactly its purchased total plus the allowance, or to its purchased total when no allowance is set.
  • It walks the members only until every limit is in place, then does nothing per member until the next start.
  • Each grant reads the member's purchased total again just before it's sent, so a purchase granted in the meantime isn't taken back.
  • Mediators are left out, since MediatorUnlimitedTrafficTrigger keeps their limits unlimited.
  • So are members the sequencer has no traffic state for yet.
• While it's set, purchases pay down the credit, because the reconcile trigger only ever raises a limit to the purchased total. A purchase ingested while the limits are being set back is picked up by the reconcile trigger and the next pass.
• Warnings:
  • every outage-traffic-allowance-warning-interval (5 minutes) while the allowance is set, giving the allowance, the members it covers and the total credit outstanding;
  • when traffic is bought for a member, or the DSO merges a member's traffic contracts, while the allowance is set, since either means the global synchronizer is reachable again;
  • once, when the allowance is set, naming the members with a purchase on record but no traffic state on the sequencer, which only get the allowance after another restart;
  • for each member whose limit doesn't reach its target, at most once per warning interval, with the same text at info in between, whether the allowance is set or removed. On a synchronizer whose sequencers several operators run, this is what an operator sees until enough of them send the same limit: until they have all set, or removed, the same allowance and seen the same purchases.
• Config: both settings must be positive. An allowance of 0 would count as set, and an interval of 0 would run the warning in a tight loop.
• Validator top-up:
  • When a member's remainder is below zero, the top-up buys that shortfall together with the normal top-up in one purchase, and the funds check prices both. Before, it bought one top-up per minTopupInterval and left the member blocked for several intervals.
  • If the wallet doesn't cover both, it buys the top-up alone, which still pays the shortfall down one interval at a time, and warns.
  • When even the top-up alone doesn't fit, the insufficient-funds warning names both amounts.
• Store: listTotalPurchasedMemberTraffic sums the purchased totals per member on the operator's synchronizer in one query.

Two consequences for the runbook:

• Every start without the allowance sets limits back to the purchased totals, so it also takes back traffic granted by hand above the purchases.
• A restart with the allowance still set, after purchases have landed, gives each member the full allowance again on top of its new total.

Tests.

• SyncOperatorTrafficIntegrationTest runs the whole flow:
  • The operator's participant is disconnected from the global synchronizer, and the app restarts with a 50 KB allowance. Each limit rises by exactly the allowance, and a second restart moves nothing.
  • Bob transacts past what was bought for him and is refused at the allowance. Alice transacts on what was bought for her without touching the allowance.
  • After reconnecting, a purchase for bob logs the warning and leaves his limit where it was.
  • With the allowance removed, the limits go back to the purchased totals and alice keeps transacting. Bob is refused until one top-up buys his shortfall (27.5 KB) together with his 12 KB top-up.
  • To change the config mid-test, a second instance of the app with the allowance set shares the first one's store and is started by hand. It's added in the test rather than in sync-operator-topology.conf, which other tests load.
• Unit tests for the targets, the members left out, the warning rate limit, the shortfall purchase with its fallback and cost, and the store query.

Not run locally: SyncOperatorLsuIntegrationTest. Testing with several operators is a follow-up once the multi-node topology lands (ChainSafe/canton-extending-mainnet#106).