Fixes [A-354](https://linear.app/aztec-labs/issue/A-354/integrate-slash-protection-in-signing-path)

Integrates the existing validator HA signer into validator-client via a new `HAKeyStore` wrapper, adds type-safe duty identifiers using discriminated unions, and includes integration testing with multiple validator nodes.

## What's New

### 1. HAKeyStore Implementation

**New File**: `yarn-project/validator-client/src/key_store/ha_key_store.ts`

Transparent wrapper around `ExtendedValidatorKeyStore` that adds HA coordination:

- Drop-in replacement for any `ExtendedValidatorKeyStore` implementation
- AUTH_REQUEST duties bypass HA coordination (safe to sign multiple times)
- Signs with all addresses concurrently using `Promise.allSettled()`, filtering out already-signed duties

```typescript
// With HA protection
const sigs = await haKeyStore.signTypedData(typedData, {
  slot: 100n,
  blockNumber: 50n,
  blockIndexWithinCheckpoint: 0,
  dutyType: DutyType.BLOCK_PROPOSAL,
});

// Without HA protection (AUTH_REQUEST)
const sigs = await haKeyStore.signTypedData(typedData, {
  dutyType: DutyType.AUTH_REQUEST,
});
```

### 2. Type-Safe Duty Identifiers

**Modified**: `yarn-project/validator-ha-signer/src/db/types.ts`

Replaced optional `blockIndexWithinCheckpoint?: number` with discriminated unions:

```typescript
type DutyIdentifier =
  | BlockProposalDutyIdentifier // MUST have blockIndexWithinCheckpoint >= 0
  | OtherDutyIdentifier; // Does NOT have this field

interface BlockProposalDutyIdentifier {
  validatorAddress: EthAddress;
  slot: SlotNumber;
  blockIndexWithinCheckpoint: number; // Required
  dutyType: DutyType.BLOCK_PROPOSAL;
}
```

Enforces correctness at compile-time and prevents invalid database primary keys.

### 3. Extended Duty Type Support

Added: `CHECKPOINT_PROPOSAL`, `GOVERNANCE_VOTE`, `SLASHING_VOTE`, `AUTH_REQUEST`

### 4. Integration Test

**New File**: `yarn-project/validator-client/src/validator.ha.integration.test.ts`

E2E test with 5 validators sharing a PostgreSQL database. Tests concurrent block proposals, attestations, checkpoint proposals, and slashing protection.

## Key Changes

### Cleanup Timeout Configuration

Made `maxStuckDutiesAgeMs` dynamically computed from actual slot duration:

```typescript
const haConfig = {
  ...config,
  maxStuckDutiesAgeMs:
    config.maxStuckDutiesAgeMs ??
    epochCache.getL1Constants().slotDuration * 2 * 1000,
};
```

### SigningContext Now Required

All `ValidatorKeyStore` signing methods now require `SigningContext` parameter. Updated `LocalKeyStore`, `NodeKeystoreAdapter`, `Web3SignerKeyStore`, and new `HAKeyStore`.

### Database Schema

Added `block_index_within_checkpoint` to primary key to support multiple block proposals per slot:

```sql
PRIMARY KEY (validator_address, slot, duty_type, block_index_within_checkpoint)
```

## Configuration

```bash
VALIDATOR_HA_DATABASE_URL=postgresql://user:pass@host:port/db
VALIDATOR_HA_SIGNING_ENABLED=true
VALIDATOR_HA_NODE_ID=validator-node-1
VALIDATOR_HA_POLLING_INTERVAL_MS=100        # Optional
VALIDATOR_HA_SIGNING_TIMEOUT_MS=3000        # Optional
VALIDATOR_HA_MAX_STUCK_DUTIES_AGE_MS=144000 # Optional (defaults to 2× slot duration)
```

## Notes

- HA is opt-in via `VALIDATOR_HA_SIGNING_ENABLED=true`
- Non-HA validators work unchanged
- Lock-free read operations
- Atomic lock acquisition using `INSERT ... ON CONFLICT` with retry logic (10ms, 20ms, 30ms backoff) to handle PostgreSQL transaction visibility edge cases in high-concurrency scenarios