Add dAuth job secret endpoints

[aledefra]

Summary

• Add /add_secrets for full job secret bundle writes from signed protocol-oracle requests.
• Add /get_secrets for R1FS-authorized job runners.
• Require signed hex-millisecond timestamp nonces no older than 120 seconds on both endpoints.
• Echo the request nonce in signed success and error responses.
• Encrypt GET bundles to the signed requester and return only encrypted_secret_bundle.
• Keep the single write shape {job_id, job_secrets} and overwrite semantics.

Stack

• Stacked on Gate dAuth by registry oracles #454 (codex/dauth-registry-gating). After Gate dAuth by registry oracles #454 merges, retarget this PR to develop.

Security Model

Timestamp nonces provide a stateless 120-second freshness bound, not strict one-time use. Strict prevention of replay inside that window would require consumed-nonce state or monotonic counters.

Open Questions

• Decide later whether partial merge/update semantics are needed.
• Delete endpoints remain out of scope.

Tests

• dAuth discovery: 15 passed on this branch; 21 passed at the top of the full stack
• Deeploy discovery at stack top: 215 passed
• compile and diff checks: passed