Harden block-recording pipeline: P0 reliability fixes

Closes the silent-failure modes between "ckpool logs a solve" and
"block correctly displayed":

* Difficulty estimate matched mempool.space — the projection now uses
  (inEpoch + 1) intervals so it converges on Bitcoin Core's eventual
  retarget formula at end-of-epoch instead of undershooting by ~0.05–
  0.10 % throughout.

* Tailer resumes mid-log on restart — persists (inode, offset) to kv
  every EOF + on shutdown, and replays the unread tail next time. Any
  solve line written while kamado-api was down would previously be
  invisible forever.

* Background reconcile loop (60 s) retries hash/reward enrichment for
  blocks the original RPC missed, so a transient bitcoind-index race no
  longer permanently leaves a block hashless.

* Reorg detection: same loop compares each recent stored hash against
  getblockhash(height); a mismatch stamps orphaned_at. UI renders these
  strikethrough with a red "orphaned" tag instead of showing illusory
  rewards forever.

* InsertBlock now reports whether a row was actually inserted; the
  caller WARN-logs duplicate-height ignores so a re-mined orphaned
  height can't disappear silently.

* Submit-attempt vs confirmed counters surface failed submissions:
  every "Possible/Submitting block solve" log line increments
  block_submit_attempts; "Solved and confirmed" increments
  block_submits_confirmed. A growing gap means bitcoind is rejecting
  our submissions — previously invisible.

* share_err patch refreshed against pinned ckpool source: added
  SE_NO_JOBID -> 21 and SE_WORKER_MISMATCH -> 24 mappings, kept
  SE_INVALID_NONCE2 in 20 (it's a malformed-input error, not low-diff).
  AxeOS users now see actionable Stratum codes instead of
  "unknown error".

UI gets new orphaned_at + block_submit_attempts/confirmed fields on
the snapshot type and a strikethrough-with-tag rendering for orphaned
blocks in BlocksTable.

ckpool/patches/0003-share-error-as-stratum-array.patch

@@ -1,8 +1,8 @@
 diff --git a/src/stratifier.c b/src/stratifier.c
-index 8281fa0..47d0fed 100644
+index 8281fa0..52da790 100644
 --- a/src/stratifier.c
 +++ b/src/stratifier.c
-@@ -6004,7 +6004,30 @@ static void check_best_diff(sdata_t *sdata, user_instance_t *user,worker_instanc
+@@ -6004,7 +6004,32 @@ static void check_best_diff(sdata_t *sdata, user_instance_t *user,worker_instanc
  	stratum_send_message(sdata, client, buf);
  }
  
@@ -15,8 +15,9 @@ index 8281fa0..47d0fed 100644
 +static inline int share_err_code(enum share_err err)
 +{
 +	switch (err) {
-+	case SE_STALE:
++	case SE_NO_JOBID:
 +	case SE_INVALID_JOBID:
++	case SE_STALE:
 +	case SE_NTIME_INVALID:
 +		return 21; /* job not found / stale */
 +	case SE_DUPE:
@@ -24,6 +25,7 @@ index 8281fa0..47d0fed 100644
 +	case SE_HIGH_DIFF:
 +		return 23; /* low difficulty share */
 +	case SE_NO_USERNAME:
++	case SE_WORKER_MISMATCH:
 +		return 24; /* unauthorized worker */
 +	default:
 +		return 20; /* other / unknown */