Harden block-recording pipeline: P0 reliability fixes

Closes the silent-failure modes between "ckpool logs a solve" and
"block correctly displayed":

* Difficulty estimate matched mempool.space — the projection now uses
  (inEpoch + 1) intervals so it converges on Bitcoin Core's eventual
  retarget formula at end-of-epoch instead of undershooting by ~0.05–
  0.10 % throughout.

* Tailer resumes mid-log on restart — persists (inode, offset) to kv
  every EOF + on shutdown, and replays the unread tail next time. Any
  solve line written while kamado-api was down would previously be
  invisible forever.

* Background reconcile loop (60 s) retries hash/reward enrichment for
  blocks the original RPC missed, so a transient bitcoind-index race no
  longer permanently leaves a block hashless.

* Reorg detection: same loop compares each recent stored hash against
  getblockhash(height); a mismatch stamps orphaned_at. UI renders these
  strikethrough with a red "orphaned" tag instead of showing illusory
  rewards forever.

* InsertBlock now reports whether a row was actually inserted; the
  caller WARN-logs duplicate-height ignores so a re-mined orphaned
  height can't disappear silently.

* Submit-attempt vs confirmed counters surface failed submissions:
  every "Possible/Submitting block solve" log line increments
  block_submit_attempts; "Solved and confirmed" increments
  block_submits_confirmed. A growing gap means bitcoind is rejecting
  our submissions — previously invisible.

* share_err patch refreshed against pinned ckpool source: added
  SE_NO_JOBID -> 21 and SE_WORKER_MISMATCH -> 24 mappings, kept
  SE_INVALID_NONCE2 in 20 (it's a malformed-input error, not low-diff).
  AxeOS users now see actionable Stratum codes instead of
  "unknown error".

UI gets new orphaned_at + block_submit_attempts/confirmed fields on
the snapshot type and a strikethrough-with-tag rendering for orphaned
blocks in BlocksTable.

api/cmd/kamado-api/main.go

@@ -8,10 +8,13 @@ package main
 import (
 	"context"
 	"errors"
+	"fmt"
 	"log/slog"
 	"net/http"
 	"os"
 	"os/signal"
+	"strconv"
+	"strings"
 	"syscall"
 	"time"
 
@@ -78,10 +81,40 @@ func main() {
 
 	go agg.Run(ctx, zmq.Events)
 
+	// Background reconciliation: retry hash/reward enrichment for blocks
+	// the initial RPC lookup couldn't fetch, and detect chain reorgs by
+	// comparing recorded hashes against the canonical chain.
+	go agg.ReconcileBlocks(ctx)
+
 	// Tail the ckpool log for block-solve events (our own solves).
 	tailer := logmon.New(cfg.CKPoolLogFile, log)
+	if blockStore != nil {
+		const cursorKey = "logmon_cursor"
+		tailer.LoadCursor = func() (uint64, int64, bool) {
+			v, err := blockStore.GetKV(cursorKey)
+			if err != nil || v == "" {
+				return 0, 0, false
+			}
+			parts := strings.SplitN(v, ":", 2)
+			if len(parts) != 2 {
+				return 0, 0, false
+			}
+			ino, err1 := strconv.ParseUint(parts[0], 10, 64)
+			off, err2 := strconv.ParseInt(parts[1], 10, 64)
+			if err1 != nil || err2 != nil {
+				return 0, 0, false
+			}
+			return ino, off, true
+		}
+		tailer.SaveCursor = func(ino uint64, off int64) {
+			if err := blockStore.SetKV(cursorKey, fmt.Sprintf("%d:%d", ino, off)); err != nil {
+				log.Warn("logmon cursor persist failed", "err", err)
+			}
+		}
+	}
 	go tailer.Run(ctx)
 	go agg.IngestBlockEvents(ctx, tailer.Events)
+	go agg.IngestAttemptEvents(ctx, tailer.Attempts)
 
 	srv := &http.Server{
 		Addr:              cfg.ListenAddr,