fix: Unified Witness RPC with Cloudflare Fallback

[flyq]

Summary

• Add optional Cloudflare witness provider as a fallback endpoint for fetching witness data for pruned/archived blocks via Cloudflare KV.
• Refactor RpcClient witness fetching by extracting shared fetch-and-decode logic into a private fetch_witness_from_provider method, used by both the primary get_witness and the new get_witness_from_cloudflare paths.
• Unify the RPC interface: both the upstream witness generator and the Cloudflare KV worker use the same mega_getBlockWitness method with WitnessRequestKeys, returning a "v0:<base64(zstd(bincode))>" encoded response.

Changes

File	Description
crates/validator-core/src/rpc_client.rs	Add cloudflare_witness_provider field to RpcClient; add new_with_config parameter cloudflare_witness_api; extract fetch_witness_from_provider; add has_cloudflare_provider() and get_witness_from_cloudflare() public methods; move metrics reporting to get_witness; improve error/trace messages with source tag; add unit tests
bin/stateless-validator/src/main.rs	Pass None for Cloudflare fallback in validator construction; update test mock to match unified RPC format
bin/debug-trace-server/src/main.rs	Pass None for Cloudflare fallback in trace server construction

Test Plan

• Added test_new_with_valid_url — verifies default client has no Cloudflare provider
• Added test_new_with_cloudflare_provider — verifies Cloudflare provider is present when configured
• Added test_new_with_invalid_cloudflare_url — verifies invalid URL returns error
• Existing test_skip_block_verification updated for new signature
• Integration test: verify primary witness fetch still works end-to-end
• e2e test of generator & validator