feat: continue implementing oprf-accountant v2

[fabian1409]

Note

Medium Risk
Touches billing semantics, private-key signing, and a breaking DB shape; votes are not fully submitted on-chain yet, so behavior in production depends on finishing submission and aligning with the pending currentVoteEpoch contract API.

Overview
Adds a background OprfAccountantService that periodically calls BillingContract.currentVoteEpoch(), waits for the configured post-epoch offset, aggregates per-RP request counts from Postgres for the epoch’s [epochStart, epochEnd) span, and builds EIP-712–signed SignedVoteChunks for submitBillingVotes (on-chain submission is still commented out pending wallet/signer split and contract ABI).

Storage and ingestion: The rp_signatures migration is reshaped for v2—drops per-row epoch and the (rp_id, nonce, epoch) uniqueness rule, adds action and optional wip101_data, and makes signature nullable. Batch inserts persist the new fields; POST /req now returns 500 on DB errors. rp_counts_for_epoch_span supplies vote data with COUNT(DISTINCT nonce) per rp_id, ordered for the contract.

Wiring: Config gains billing contract address, RPC, wallet key, tick/vote timeouts, voting-window offset, and vote chunk size. Startup spawns the accountant loop alongside Axum and joins it on shutdown. Unit/integration tests cover vote-window logic, chunk signing, and aggregation edge cases. Cargo.lock picks up alloy/web3 and taceo-nodes-common test-deps (e.g. axum-test).

^{Reviewed by Cursor Bugbot for commit 90766b9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 6 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 5d6ff03. Configure here.}

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: cargo tokio is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: Cargo.lock → cargo/tokio@1.50.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/tokio@1.50.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[0xThemis]

nit: maybe add some .context() here to the three ?. Helps in case this actually happens