feat: replace dna_hashes/dna_modifiers with role-centric roles config

[zippy]

Fixes #14.

Config now mirrors Holochain's app model — each role carries its own DNA hash and modifiers:

"roles": {
  "main": {
    "dna_hash": "uhC0k...",
    "modifiers": { "network_seed": "...", "properties": { "progenitor_pubkey": "uhCAk..." } }
  }
}

This replaces dna_hashes and the global dna_modifiers outright — no compatibility layer. A config still containing the old keys fails at startup with an error pointing at roles.

• dna_hash is required only when membrane proofs are enabled — it exists solely to bind proofs to a network. When present it is strictly validated (39-byte HoloHash, DnaHash prefix), so a role name can no longer masquerade as a hash. Configure the post-modifiers DNA hash, read from the conductor that installed the DNA (see DEPLOYMENT.md's "Obtaining the DNA hash") — the bundle's base hash produces proofs that never validate.
• Provision response: per-role roles: { <role>: { membrane_proof?, dna_modifiers? } }, mirroring hc s call install-app --roles-settings. The old membrane_proofs map and top-level dna_modifiers are gone.
• /v1/info: per-role dna_modifiers under roles (never DNA hashes or proofs); top-level dna_modifiers is gone.
• CLI roles-settings YAML emits each role's own modifiers.

[ThetaSinner]

Is this structured the right way round? If I have the same role, over multiple networks, I require duplicate keys in a map.

Or is this change prior to handling multiple networks?

I'd expect the DNA hash to be the top level key perhaps?

[zippy]

Or is this change prior to handling multiple networks?

Yes, this is prior to handling multiple-networks, that's coming next, and things will be keyed by happ-id and this will no longer conflict. I wanted to just get the role shape in place first.

[zippy]

multi-network is in #19

[ThetaSinner]

Fine, happy with this as a stepping stone towards multi network support