feat(consensus): consensus node restore-state command

Implement `solo-provisioner consensus node restore-state` command to download a Merkle state snapshot before starting a node.

Parent epic: #408
Depends on: #1044, #1045

### Context
Per HIP-1494, the deployment package may contain `manifests/state-sources.yaml` listing cloud storage buckets with per-node state snapshot index files. When a node needs to join an existing network (not genesis bootstrap) or recover from state loss, the provisioner must download a recent Merkle snapshot into `data/saved/` before the CN process starts.

This command must be run **before** `consensus node start` when state is needed.

### When to use
- New node joining an existing network (after `node add`, before `node start`)
- Disaster recovery (local state lost or corrupted)
- NOT needed for: fresh genesis bootstrap, standard upgrades, Docker-to-K8s migration

### Scope
- `solo-provisioner consensus node restore-state --node-id [--deployment-package-dir ] | --state-sources-file [--namespace] [--orbit]`
- Read `manifests/state-sources.yaml` from deployment package
- Support **private buckets**: credentials via `--state-credentials ` flag or default path `/opt/solo/weaver/daemon/credentials/state-sources-credentials.yaml`
- Support GCS (service account JSON), S3 (access key/secret key), and potentially Azure Blob credentials
- Query per-node index files to find the latest available round
- Download the Merkle snapshot for the target node from `///`
- Place downloaded state into the CN's `data/saved/` volume (hostPath or PVC)
- Validate download integrity (checksums if available)
- Precheck: ConsensusCapsule exists, CN process is not running

### state-sources.yaml structure (from HIP-1494)
Lists cloud storage buckets (GCS, S3) with:
- Per-node index files containing the latest available round number
- Bucket paths to download the corresponding Merkle state snapshot
- Buckets may be private — requires cloud provider credentials for access

### Acceptance Criteria
- [ ] Reads state-sources.yaml from deployment package
- [ ] Authenticates to private cloud storage buckets (GCS, S3) with credentials
- [ ] `--state-credentials` flag for custom credentials path
- [ ] Falls back to default credentials path if flag not provided
- [ ] Selects latest round from index files
- [ ] Downloads Merkle snapshot into correct data/saved/ path
- [ ] Validates download integrity
- [ ] Rejects if CN process is currently running
- [ ] Clear progress output during download (state can be 2-10 TB)