fix(chains): drop node URLs that embed Nova's provider keys (#72)

* fix(chains): drop node URLs that embed Nova's Infura keys

Nova's configs carry Nova's own Infura project keys inside node URLs, and
every sync copied them into ours: Ethereum had four keyed Infura nodes and
Base one, across 43 published files. Our Android build already fills
`{INFURA_API_KEY}` from our own secret; the keyed URLs used another
organisation's quota and would break for every user when Nova rotates them.

- sync_from_nova.py strips nodes whose URL embeds an Infura key, and drops a
  chain left with no node (only Ethereum - Goerli, a retired testnet, in the
  dev files); merge-chains.py applies the same filter
- the published chain files are rewritten with that filter; nothing else in
  them changes (each file round-trips byte for byte through json.dump)
- check_pezkuwi_integrity.py refuses a keyed Infura URL under chains/

* fix(chains): strip every keyed provider URL, and make the gate fail closed

The first pass matched only `infura.io/.../v3/<lowercase hex>`, so it missed
`https://...infura.io/v3/<key>`, upper-case keys and hosts, and Nova's
OnFinality `?apikey=` URLs (Moonriver, and the Hades testnet in v20/v21
preConfigured). preConfigured was copied from Nova without the filter, and the
integrity check passed if grep itself failed.

- one predicate, is_keyed(), in sync_from_nova.py: Infura /v3/ ids and
  apikey/api_key/key/token query values, case-insensitive; {PLACEHOLDER}
  values are allowed
- preConfigured details are filtered after the copy; a chain left with no
  node loses its details file and its index entry (Hades, v20/v21 only)
- rewritten files keep their own indent, so the diff is the data change only
- check 5 imports is_keyed() and checks every string in every JSON file
  under chains/; an unreadable file or an empty tree is an error
- check 3 reports a grep error instead of passing on it

scripts/merge-chains.py

@@ -15,8 +15,12 @@ Options:
 
 import json
 import argparse
+import sys
 from pathlib import Path
 
+sys.path.insert(0, str(Path(__file__).parent))
+from sync_from_nova import strip_keyed_endpoints  # noqa: E402
+
 # Base paths
 SCRIPT_DIR = Path(__file__).parent
 ROOT_DIR = SCRIPT_DIR.parent
@@ -151,6 +155,9 @@ def merge_chains(nova_chains: list, pezkuwi_chains: list, filter_broken: bool =
         nova_filtered.append(chain)
         stats['nova_included'] += 1
 
+    nova_filtered = strip_keyed_endpoints(nova_filtered)
+    stats['nova_included'] = len(nova_filtered)
+
     # Pezkuwi first, then Nova
     merged = pezkuwi_chains + nova_filtered
     stats['total'] = len(merged)