Harden block-recording pipeline: P0 reliability fixes

Closes the silent-failure modes between "ckpool logs a solve" and
"block correctly displayed":

* Difficulty estimate matched mempool.space — the projection now uses
  (inEpoch + 1) intervals so it converges on Bitcoin Core's eventual
  retarget formula at end-of-epoch instead of undershooting by ~0.05–
  0.10 % throughout.

* Tailer resumes mid-log on restart — persists (inode, offset) to kv
  every EOF + on shutdown, and replays the unread tail next time. Any
  solve line written while kamado-api was down would previously be
  invisible forever.

* Background reconcile loop (60 s) retries hash/reward enrichment for
  blocks the original RPC missed, so a transient bitcoind-index race no
  longer permanently leaves a block hashless.

* Reorg detection: same loop compares each recent stored hash against
  getblockhash(height); a mismatch stamps orphaned_at. UI renders these
  strikethrough with a red "orphaned" tag instead of showing illusory
  rewards forever.

* InsertBlock now reports whether a row was actually inserted; the
  caller WARN-logs duplicate-height ignores so a re-mined orphaned
  height can't disappear silently.

* Submit-attempt vs confirmed counters surface failed submissions:
  every "Possible/Submitting block solve" log line increments
  block_submit_attempts; "Solved and confirmed" increments
  block_submits_confirmed. A growing gap means bitcoind is rejecting
  our submissions — previously invisible.

* share_err patch refreshed against pinned ckpool source: added
  SE_NO_JOBID -> 21 and SE_WORKER_MISMATCH -> 24 mappings, kept
  SE_INVALID_NONCE2 in 20 (it's a malformed-input error, not low-diff).
  AxeOS users now see actionable Stratum codes instead of
  "unknown error".

UI gets new orphaned_at + block_submit_attempts/confirmed fields on
the snapshot type and a strikethrough-with-tag rendering for orphaned
blocks in BlocksTable.

ui/src/lib/BlocksTable.svelte

@@ -30,8 +30,13 @@
         </thead>
         <tbody>
           {#each blocks as b (b.height + "-" + b.found_at)}
-            <tr>
-              <td class="mono">{b.height}</td>
+            <tr class:orphaned={!!b.orphaned_at}>
+              <td class="mono">
+                {b.height}
+                {#if b.orphaned_at}
+                  <span class="orphan-tag" title="Reorged out of the canonical chain at {b.orphaned_at}">orphaned</span>
+                {/if}
+              </td>
               <td class="hash-cell">
                 {#if b.hash}
                   <a
@@ -99,6 +104,23 @@
   .reward-num {
     font-variant-numeric: tabular-nums;
   }
+  tr.orphaned td {
+    color: var(--fg-dim);
+    text-decoration: line-through;
+    text-decoration-color: rgba(220, 80, 80, 0.55);
+  }
+  tr.orphaned .orphan-tag {
+    display: inline-block;
+    margin-left: 0.4em;
+    padding: 0.05em 0.4em;
+    border-radius: 3px;
+    background: rgba(220, 80, 80, 0.15);
+    color: rgb(220, 110, 110);
+    font-size: 0.7em;
+    font-weight: 600;
+    text-decoration: none;
+    vertical-align: middle;
+  }
   .unit {
     color: var(--fg-dim);
     font-size: 0.75em;

ui/src/types.ts

@@ -94,6 +94,10 @@ export type BlockRecord = {
   found_at: string; // RFC 3339
   source: string;
   share_diff?: number;
+  // Set when the periodic chain reconciler finds the recorded hash no
+  // longer matches the canonical block at this height (network reorged
+  // us out). UI renders these strikethrough.
+  orphaned_at?: string; // RFC 3339, omitted when zero
 };
 
 export type HashratePoint = {
@@ -123,6 +127,11 @@ export type Snapshot = {
   // Optional override for explorer links. Empty/undefined means the
   // UI falls back to its mempool.space defaults.
   mempool_base_url?: string;
+  // Submission attempt tracking — count of "Possible block solve"
+  // log lines vs "Solved and confirmed" lines. A growing gap means
+  // submissions are being rejected by bitcoind.
+  block_submit_attempts: number;
+  block_submits_confirmed: number;
   ckpool_ok: boolean;
   bitcoin_ok: boolean;
   last_error?: string;