[STACKED on #957] feat(kms): authorize from finalized Ethereum snapshots

[kvinwang]

STACKED PR — merge #957 first.

Problem

Ethereum authorization read the latest chain state, which can be reorganized. A decision based on an unfinalized block could later disappear or change while KMS had already issued access.

Root cause and fix

Evaluate policy against a finalized block/snapshot and bind the decision to that finalized state.

Implementation

The branch records the following focused implementation work:

• test(kms): cover Ethereum authorization freshness
• test(kms): define Ethereum finalized snapshots
• feat(kms): authorize from finalized Ethereum snapshots
• fix(kms): assert redacted backend diagnostics

Changed paths:

• dstack/kms/auth-eth-bun/index.test.ts
• dstack/kms/auth-eth-bun/index.ts

Scope

This PR addresses one logical kms finding. It intentionally excludes the acceptance-test infrastructure from #841 and unrelated product fixes from #840.

Dependency and merge order

• Parent PR: [STACKED on #956] fix(kms): align Node authorization safety #957
• GitHub base branch: codex/fix-kms-node-auth-safety
• Merge the parent first; this PR contains only the additional delta above that parent.

Verification

• git diff --check origin/codex/fix-kms-node-auth-safety..origin/codex/feat-kms-finalized-ethereum-auth: passed.
• The declared base was verified as an ancestor of the PR head.
• Focused compile/check verification was run for the changed component where applicable; non-Rust packaging or configuration changes were reviewed against their exact branch delta.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.