[GoldenTuxbee]

Summary

Hardens the indexer's health server against an unbounded/unauthenticated probe port and a wedged poll loop, and fixes two Helm availability gaps: the gRPC API running as a single replica with no PDB/HPA, and nginx running one replica with a PDB that blocked node drains on an EOL floating image tag.

closes #764
closes #765
closes #766

Changes

• indexer: health server has no read timeout, exposes /admin/dead-letter unauthenticated, and readiness ignores the poll loop #764 - indexer health server hardening: crates/indexer/src/health.rs now bounds request-line/header reads with a 5s timeout and an 8KiB budget, so a slowloris-style client can't hold a socket open forever or force unbounded buffering. /admin/dead-letter requires a shared-secret Authorization: Bearer <ADMIN_TOKEN> header; with ADMIN_TOKEN unset the endpoint 404s instead of staying open. /readyz now also fails once the poll loop's heartbeat (new crates/indexer/src/liveness.rs, shared with the streamer via heartbeat.record() each iteration) is older than READINESS_HEARTBEAT_STALE_SECS (default 120s). Two new optional env vars: ADMIN_TOKEN, READINESS_HEARTBEAT_STALE_SECS.
• infrastructure: Helm deploys the gRPC API as a single replica with no PDB or autoscaling #765 - gRPC API availability: helm/trident/values.yaml raises grpcApi.replicaCount default from 1 to 2 and adds podDisruptionBudget (minAvailable: 1), topologySpreadConstraints, and hpa blocks mirroring the existing goApi configuration. helm/trident/templates/grpc-api-deployment.yaml gets the matching topology spread on the pod spec plus a PDB and HPA template, same structure as the Go API's.
• infrastructure: Helm nginx runs one replica with minAvailable: 1, blocking node drains, on an EOL floating image tag #766 - nginx availability and image: nginx.replicaCount default raised from 1 to 2. The PDB switched from minAvailable: 1 to maxUnavailable: 1 (in both values.yaml and values-prod.yaml), and the template's replicaCount > 1 render gate was dropped since maxUnavailable never forbids every voluntary disruption the way minAvailable: 1 did at a single replica. Added topologySpreadConstraints for nginx. The image is now pinned by tag and digest, nginx:1.27-alpine (current stable mainline, replacing the EOL 1.25-alpine) at sha256:65645c7bb6a0661892a8b03b89d0743208a18dd2f3f17a54ef4b76fb8e2f2a10, satisfying the existing digest-pinning convention from Infra: pin all remaining floating base images and GitHub Action versions to digests #303.

Not included

• infrastructure: Helm deploys the gRPC API as a single replica with no PDB or autoscaling #765's Go client load-balancing note: the issue's scope asks to "confirm the Go client load-balances across endpoints." I checked services/api/grpc/client.go: it dials a single address with grpc.NewClient and no WithDefaultServiceConfig round_robin policy, and the Service is ClusterIP (not headless), so it keeps one long-lived HTTP/2 connection to a single gRPC API pod regardless of replica count. Scaling replicas and adding a PDB still improves availability (a killed/drained pod now forces a fast reconnect through the client's existing backoff/keepalive config, instead of every REST read failing outright), but genuine load spreading across replicas needs a client-side change (headless Service + round_robin policy, or an L7 proxy) that touches Go application code and felt too large to make correctly and safely as part of this Helm-only batch. Flagging it rather than guessing at a fix.

Test plan

• cargo build -p trident-indexer: compiles cleanly with these changes. Note: upstream/dev currently fails to build/test as-is due to two pre-existing, unrelated issues in crates/indexer/src/redis_stream/relay.rs (a borrow-checker error) and a stale RelayConfig test fixture in crates/indexer/src/streamer/mod.rs missing its network field; verified by stashing this branch's changes and reproducing the same failures against a clean upstream/dev checkout. Neither touches any file this PR changes.
• cargo test -p trident-indexer --bin trident-indexer health:: / liveness:: / config::: all pass, including new unit tests for the bearer-token check and the heartbeat-staleness readiness path, plus the existing /admin/dead-letter schema regression tests.
• helm lint helm/trident and helm template helm/trident (default, -f values.yaml -f values-prod.yaml, and -f values.yaml -f values-staging.yaml): all render without error. Manually inspected the rendered output for the gRPC API's PDB/HPA, nginx's PDB (maxUnavailable: 1), and the nginx image reference (nginx:1.27-alpine@sha256:...).

---

Staging and the indexer's own single-replica design are intentionally left alone (staging already scales these services down with its own documented reasoning; the indexer's replicaCount: 1 is a deliberate single-poll-loop design, not the gap these issues describe). ADMIN_TOKEN is wired into helm/trident/templates/indexer-deployment.yaml as an optional key on the chart's existing secret (global.existingSecret); a deployment that doesn't set it simply runs with /admin/dead-letter disabled, same as running the indexer outside Helm.