Closes gap-analysis v2 §7.7.
- API_KEYS entries now accept the form key:role (back-compat: bare keys
default to role=operator). Known roles come from ActorRole in
transactionState.ts (coordinator / approver / releaser / validator /
exception_manager / operator).
- apiKeyAuth + optionalApiKeyAuth inject req.actorRole alongside
req.apiKey so the SoD enforcement in the state machine can consult
the authenticated role directly.
- New requireRole(...roles) guard for per-route role gating.
- Fail-closed: unknown roles are skipped during parsing, not silently
promoted to operator. Cache auto-invalidates when API_KEYS changes.
- 9 unit tests.
- Integrated ECDSA for signature verification in ComboHandler.
- Updated event emissions to include additional parameters for better tracking.
- Improved gas tracking during execution of combo plans.
- Enhanced database interactions for storing and retrieving plans, including conflict resolution and status updates.
- Added new dependencies for security and database management in orchestrator.
