feat: network guard, rate limiter, alerting, historical charts, and read-only mode

[btcneves]

Summary

• Network guard — detects Bitcoin chain (regtest/testnet/mainnet) on startup and enforces read-only mode outside regtest; all write-protected endpoints return 403 with chain context on mainnet/testnet; NODESCOPE_FORCE_READONLY env var for manual override
• Rate limiter middleware — sliding-window protection per IP with configurable RATE_LIMIT_RPM (default 600) and RATE_LIMIT_WRITE_RPM (default 30); exempt paths for SSE and health checks
• Alerts service — full CRUD for metric-based alert rules (mempool_size, mempool_bytes, minfee, rpc_offline) with gt/lt/eq/gte/lte operators and info/warning/critical severities; GET /alerts/evaluate for live trigger check
• Charts service — background snapshot loop storing mempool time-series; GET /charts/{metric}?range=1h|6h|24h for sparkline data; HistoricalChartsPanel with SVG polylines
• ReadOnlyBanner — orange warning banner shown across all views when node is not regtest
• Updated AlertingPanel, HistoricalDashboard, ClusterMempoolPanel and all remaining components to consume new endpoints and bilingual i18n keys
• Refreshed docs screenshots and docs/api.md with new endpoints

Test plan

• Start stack in regtest (make up) — ReadOnlyBanner must NOT appear, all write actions work
• Set NODESCOPE_FORCE_READONLY=true, restart — ReadOnlyBanner appears, mutation endpoints return 403
• Create an alert rule via POST /alerts/configs, trigger it by pushing mempool over threshold, verify GET /alerts/active returns it
• GET /charts/mempool_size?range=1h returns data after ~1 min of uptime; HistoricalChartsPanel renders sparklines
• Hammer the API past RATE_LIMIT_RPM — verify 429 responses
• npm run lint && npm run format:check pass in frontend/
• pytest tests/ passes (including test_network_guard.py)