Tighten fallback latency + alert UI on degraded states

Submit-first ordering. Patch 0004 now calls generator_submitblock
BEFORE writing the pending-block hex to disk. The happy path adds zero
disk I/O — we only dump when the primary returned false. The same
patch bounds generator_submitblock's "no live current_si" spin to
~3s instead of the original infinite loop, so a permanently-down
primary doesn't pin the stratifier; the bounded spin lets the caller
return false and lets local_block_submit dump for kamado-api to take
over.

Default grace lowered from 30s to 3s. With ckpool's bounded spin and
sub-second sweep cadence, the fallback now reacts within ~4s of a
failed primary submit — fast enough that the work is still relevant
for the current chain tip. The submitter's sweep poll dropped to 1s
to match.

UI HealthBanners. New top-of-page strip surfaces:
  * Fallback used (red banner, 24h after most recent event):
    "primary bitcoind didn't accept; backup X took over Y ago"
  * Submit gap (orange banner, only when no recent fallback):
    "N blocks attempted but unconfirmed — configure backups"
  * ZMQ stale (orange banner): no hashblock frame in 30+ minutes
Operators see degraded-but-not-fatal states without checking logs.

Startup readiness gate. main now waits up to 8s on agg.Ready() before
starting the HTTP server so the very first /api/snapshot doesn't show
all-zero state during the aggregator's first refresh. Capped so a
permanently-down bitcoind can't block startup; /healthz is honest
about the degraded state once we do start serving.

api/cmd/kamado-api/main.go

@@ -134,11 +134,28 @@ func main() {
 				agg.RecordFallbackSubmit(height, viaLabel)
 			},
 		}
-		go sub.Run(ctx, 5*time.Second)
+		// Sweep every second so we react within ~grace+1s of a
+		// failed submit. Reading an empty directory is cheap.
+		go sub.Run(ctx, 1*time.Second)
 	} else {
 		log.Info("blocksubmit fallback disabled (PENDING_BLOCKS_DIR not set)")
 	}
 
+	// Wait briefly for the aggregator's first refresh to complete so
+	// the very first /api/snapshot or /api/health hit doesn't see an
+	// all-zeros snapshot and report bitcoin_ok=false during its own
+	// initialization. Cap the wait so a permanently-down bitcoind
+	// can't block startup forever — /healthz is honest about the
+	// degraded state.
+	select {
+	case <-agg.Ready():
+		log.Info("first snapshot ready")
+	case <-time.After(8 * time.Second):
+		log.Warn("first snapshot not ready within 8s, serving HTTP anyway (snapshot will be partial until backends respond)")
+	case <-ctx.Done():
+		return
+	}
+
 	srv := &http.Server{
 		Addr:              cfg.ListenAddr,
 		Handler:           api.Handler(),