[PSBT Covenant] Harden covenant signer service exposure

[mswilkison]

Summary

• default the covenant signer HTTP listener to loopback and require a bearer auth token for non-loopback exposure
• stop holding the submit mutex across engine.OnSubmit so deduped callers are not serialized behind long signer work
• add focused tests for auth enforcement, config flags, and in-flight submit dedupe semantics

Testing

• go test ./pkg/covenantsigner -count=1
• go test ./pkg/tbtc -run 'TestCovenantSignerEngine_' -count=1
• go test ./cmd -count=1