fix: reject unauthenticated validator membership changes

[Alicepoltora]

Summary

• reject public validator registration before it can mutate the local ConsensusEngine quorum
• reject public validator unregistration for the same reason
• cover the fail-closed registration response with unit tests

Security rationale

Validator registration changes quorum and leader election, but the public endpoint has no authenticated authorization path. The current registration-signature check is only a non-empty placeholder, not cryptographic verification. Previously any HTTP caller could cause the receiving node to add a validator to its local consensus set immediately after DAG submission, creating a divergent quorum and a Sybil vector.

Dynamic membership should return only with an authenticated governance/validator-authorization protocol and finalized epoch-bound activation.