feat(validator): add expiring account-scoped pairing pilot

[halfaipg]

What

Add a default-empty allowlist of at most ten canonical node/human accounts and an explicit timezone-aware pilot deadline, bounded to 24 hours at startup. Public pairing stays off. Both parties are checked throughout existing-link and pending-approval flows; private lists exclude unlisted nodes. PostgreSQL checks expiry after node-lock waits. Settings repr and validation errors do not print pilot identifiers.

Why

The pairing API currently has only a global switch. Native production qualification needs a scoped, non-funded first-party pilot before any public activation. This is a rollout restriction, not an auth bypass: scoped keys, fresh human proof and explicit node signatures are unchanged.

Verification

Local full Core suite: 757 passed, 5 intentional skips. Pairing suite against disposable PostgreSQL 16.15: 70 passed, 5 SQLite-only skips. Actual node/Core integration: 5 passed; actual built Next Console/Core integration: 1 passed (SQLite and nonce fixtures explicitly remain test boundaries). Ruff and diff checks pass. Full reachable-history scan: 1560 commits clean; staged scan clean. Private schema cleanup left zero test schemas.

Risk and rollout

No schema, funding, credential issuance, account merge, payout, independence or validator economic changes. No production deployment or flag changes. Apply the reviewed code dark first, then configure only designated test identities for the separate supervised native run. Clear the pilot and global flag for rollback; never delete identities or association tables. DOX, route contract and env template updated.