[jim-toth]

Summary

Adds hyperbeam-gateway, a public service in front of a HyperBEAM node that is reachable only inside the cluster. It answers a fixed set of reads and signed messages for operator-registry, relay-rewards and staking-rewards, checks every message before it reaches the node, and builds its own request to the node instead of forwarding the client's path, query string or headers. Routes are the node's own paths, so @anyone-protocol/ao-client and the dashboard work against the gateway or a node without changes.

Changes

• apps/hyperbeam-gateway: ANS-104 parsing and Ethereum (type 3) signature verification on @noble/curves and @noble/hashes 2.4.0, low-s only.
• Operator actions are always available: Submit-Fingerprint-Certificate, Renounce-Fingerprint-Certificate, Set-Delegate and Set-Share. The gateway applies the contract's own precondition from operator-registry's operator view first, so a message the contract would reject never takes a slot.
• Admin actions are off unless listed in ADMIN_ACTIONS, and are accepted only from a signer in ADMIN_SIGNERS who also holds admin or the action's role in the process's roles view. Controller actions (Add-Scores, Complete-Round, Claim-Rewards) and Eval are not routable.
• Exact tag and data rules per action; unknown, repeated or invalid tags are refused.
• A SQLite record of accepted messages: a repeated message is answered from the record and not sent again, which also makes client retries safe.
• Views with fixed parameters and a short cache; dump is not served. Message results are served only for slots the gateway itself sent.
• Per-signer rate limit, body size cap, CORS for browser writes.
• Dockerfile and README; row in the root README. Job definitions are in Adds hyperbeam-gateway job definitions #17.

Verified

• bun run check with Bun 1.4.3: 242 pass, 1 skipped (the existing real-node test).
• Parsing and verification checked against items signed by @dha-team/arbundles 1.0.4; the test signer reproduces those items byte for byte.
• @anyone-protocol/ao-client sendMessage and readView run unchanged against the gateway backed by a stub node: a submission is accepted and its result read back, an identical resend is answered from the record with one push at the node, a refused submission surfaces as AoHttpError 403, and dump as AoNotFoundError.
• The image builds, starts as bun, answers /healthz, creates its record under /app/data, and answers 502 when no node is reachable.
• Not yet run against a real HyperBEAM node.