[H3] Fully decentralized architecture: multisig-governed contracts, community-maintained SDKs, on-chain as truth

[BigManly4]

Part of epic #808.

ROADMAP.md line 115. The end state this horizon is building toward: this app's backend stops being a trust bottleneck, because the oracle contracts, the SDKs, and the operational levers are no longer solely under one team's control.

Scope

• Multisig governance for the on-chain contracts this product depends on (corridor rate oracle, volume/savings oracle from [H3] Volume + savings: publisher write path, REST mirror, reconciliation (contract landed in #826) #873, reputation contract) -- replacing any single-admin-key control path
• SDKs ([H2] Publish TypeScript SDK to npm #806 TS, [H3] Python SDK generated from OpenAPI #821 Python, [H3] Rust SDK: OpenAPI-generated REST client (on-chain read half already exists) #868 Rust) transferred to or co-maintained under community governance, not solely this org's npm/PyPI/crates.io accounts
• "On-chain as truth": every number this product's frontend displays that claims to be verifiable (rates, fees saved, reputation scores) must be reproducible by reading the chain directly, with the backend as a convenience cache, not the source of record
• The "ripped out" test from the H3 success bar (ROADMAP.md metrics table) actually passes: if this app's backend disappeared entirely, the on-chain data it publishes must still be independently readable and meaningful

Depends on

• [H3] Multi-corridor oracle v2: migration runbook (contract landed in #825) #872 (multi-corridor oracle v2), [H3] Volume + savings: publisher write path, REST mirror, reconciliation (contract landed in #826) #873 (on-chain savings oracle), and [H2] Publish TypeScript SDK to npm #806/[H3] Python SDK generated from OpenAPI #821/[H3] Rust SDK: OpenAPI-generated REST client (on-chain read half already exists) #868 (the SDKs) all need to exist first -- this issue is decentralizing infrastructure that has to be built before it can be handed over
• This is the last item in the epic by design: everything else in [H3 EPIC] Ecosystem-infrastructure endgame #808 is a prerequisite

[ezedike-evan]

Still correctly scoped as the H3 endgame — no change, with one extraction.

The multisig governance line has been pulled out into #913 and made a named precondition of the mainnet oracle launch (#803). Reason: contracts/reputation/src/admin.rs stores a single Address that gates operational writes and, via upgrade.rs, replacing the contract WASM. That gates mainnet directly, so it cannot wait behind an H3 epic — an auditor would find it first.

The rest of this issue keeps its scope: community co-maintenance of the SDKs, and "on-chain as truth" for every verifiable number the frontend displays.

See #807 for the full H3 status pass.