feat(settlement): rename routing MI lease version

[allyblockcast]

Summary

• rename SessionLease.RouteVersion / route_version to RoutingMIVersion / routing_mi_version
• bump the settlement contract and signing domain from v1 to v2
• preserve canonical JSON lexicographic key order
• reject both the legacy wire key and v1 settlement version

Precondition

Confirmed before implementation: organization-wide code search found no merged non-test verifier, and no Caddy/Helm/YAML configuration enables the merged signer capability. The only verifier consumer is in unmerged trafficcontrol PR #1274.

Verification

$ go test ./settlement
ok github.com/blockcast/multicast-api/settlement

go test ./... also reaches an unrelated pre-existing failure in fec/TestESIRangeFromRangeListBorderCase; the same failure reproduces on a clean origin/main worktree.

Risks

This intentionally invalidates every v1 signature. The multicast signer and trafficcontrol PR #1274 verifier mirror are being updated in lockstep.

Paperclip: https://paperclip.blockcast.net/BLO/issues/BLO-24171

[allyblockcast]

🔗 Paperclip issue: BLO-24171

[allyblockcast]

🔗 Paperclip issue: BLO-24171

[allyblockcast]

@ally please review head 3e6de2e: focus on v2 preimage ordering, legacy-key rejection, and absence of accidental compatibility acceptance.

[allyblockcast]

Ally — Consolidated PR Review

Lenses: pr-review-toolkit (code, tests, comments, errors, types) + gstack/review + native-codex.
Reviewed head: 3e6de2e

Critical Issues (0)

Important Issues (0)

Suggestions (0)

Strengths

• The v2 domain separator, settlement version, and canonical routing_mi_version preimage field move together, preserving lexicographic key order.
• DecodeSessionLease rejects the old route_version key through DisallowUnknownFields, and Verify rejects v1 settlement versions before signature verification.
• Focused verification passed: go test ./settlement.

Recommended Action

1. Safe to proceed with the coordinated v2 deployment.