CLPR-4.2: Proof Construction from Merkle State

## Story CLPR-4.2: Proof Construction from Merkle State

**Parent Epic:** CLPR-4: Hiero Endpoint
**Repo:** hiero-ledger/hiero-consensus-node

### Objective

Implement `ClprStateProofManager` that constructs proof bytes from the latest immutable (TSS-signed) Merkle state.

### Acceptance Criteria

- **AC-1:** Reads latest immutable state (latest signed state). Never uses working state.
- **AC-2:** State must have a valid TSS signature. If stale (older than `clpr.maxStateAgeSeconds`, default 30s), defer proof construction.
- **AC-3:** Constructs block proof: state root hash (SHA-384, 48 bytes), round number, consensus timestamp, TSS signature, TSS public key.
- **AC-4:** Builds Merkle paths from leaf to root for: queue metadata, each unacknowledged message (from `acked_message_id + 1` through `next_message_id - 1`, capped at `max_messages_per_bundle`).
- **AC-5:** Serializes messages as `ClprMessagePayload[]`.
- **AC-6:** Packages into proof bytes protobuf (block proof + Merkle paths + queue metadata + messages).
- **AC-7:** Returns empty/null when no pending messages.
- **AC-8:** Read-only — no state mutations.

### Dependencies

- Existing: `StateProofBuilder`, `MerklePathBuilder`, TSS infrastructure
- CLPR-2.1 (queue structure)

### Risk

**High** — Deep integration with Merkle tree internals and TSS signing. Performance-sensitive.

Start by reading the existing StateProofBuilder and MerklePathBuilder integrations, then inspect the TSS infrastructure and the CLPR-2.1 queue structure referenced in the issue. Implement ClprStateProofManager around the latest immutable signed state, and verify that proof bytes include the specified block proof, paths, queue metadata, and messages while remaining read-only and empty when no messages are pending.

Written by the indexing model from the issue text.