Offchain gateway panics on nil Sender when removing a session

Nobody has claimed this yet.

An offchain gateway panics whenever it drops a session, for example when an orchestrator becomes unreachable mid-stream.

```
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x18]

server.NewSessionManager.func1(...) server/broadcast.go:543
server.(*SessionPool).removeSession(...) server/broadcast.go:456
server.(*BroadcastSessionsManager).suspendAndRemoveOrch(...) server/broadcast.go:572
server.downloadResults.func2(...) server/broadcast.go:1342
```

## Cause

`NewSessionManager` installs a cleanup callback that dereferences the payment sender unconditionally:

```go
cleanupSession := func(sessionID string) {
node.Sender.CleanupSession(sessionID)
}
```

`node.Sender` is only assigned in the on-chain branch of `cmd/livepeer/starter/starter.go`, right after the broadcaster deposit and reserve are read. Offchain it stays nil, so the call segfaults.

The callback runs whenever a session is removed: a segment download failure calls `suspendAndRemoveOrch`, which calls `removeSession`, which calls `cleanupSession`. That path is reached by ordinary conditions such as an orchestrator going offline mid-stream, a network error or a timeout, not only by misconfiguration.

Latent since #3166, because an offchain gateway usually talks to a healthy local orchestrator and never fails a download.

## Reproduce

Start an orchestrator that advertises an unreachable address, so every download fails:

```bash
./livepeer -orchestrator -transcoder -serviceAddr :8935 -cliAddr 127.0.0.1:7935 -v 6
```

Point an offchain gateway at it and push a segment:

```bash
./livepeer -gateway -orchAddr 127.0.0.1:8935 \
-httpAddr 127.0.0.1:8936 -cliAddr 127.0.0.1:5935 -rtmpAddr 127.0.0.1:1935 \
-transcodingOptions P240p30fps16x9,P360p30fps16x9 -v 6

curl -X POST --data-binary @test/e2e/test.flv http://127.0.0.1:8936/live/test/0.ts
```

The segment uploads and transcodes, the download fails on the empty host, and the gateway panics.

## Fix

Skip the cleanup when there is no sender.

## Note

The orchestrator above accepts `-serviceAddr :8935` and advertises `https://:8935`. On-chain mode rejects that through `ValidateServiceURI` and exits with a clear message; offchain skips the check and runs with an address no gateway can use. Worth handling separately.

Start in server/broadcast.go at NewSessionManager and follow the cleanupSession call through SessionPool.removeSession; inspect cmd/livepeer/starter/starter.go to compare on-chain and offchain sender setup. Reproduce with the unreachable-orchestrator commands and curl shown here. Done means removing an offchain session no longer panics, while sender cleanup still occurs when a sender exists.

Written by the indexing model from the issue text.