faucet: top-up + key custody strategy for public testnet #233
Description
Goal
Ensure the public testnet faucet cannot permanently run dry and can be replenished safely.
Scope
- Define faucet custody model:
- hot key (service) + cold reserve, or
- multisig/threshold signing, or
- operator-only manual top-up flow
- Define top-up transaction mechanism and monitoring/alerts (low balance)
- Document operational runbook (rotate keys, emergency halt)
Acceptance criteria
- Faucet balance can be replenished without redeploying the network
- There is a documented, repeatable, low-risk procedure to top up
- Alerting exists for low faucet balance and unusual drain rates
Refs: #220 (hosted faucet service), #205 (key management runbook).