feat(prospector-spectral-cover): Prospector's Bonanza — gradient $5/$3/$1 rebates with per-route SHOD guard

[srotzin]

Summary

Ships Prospector's Bonanza — a one-time gradient-rebate offer to the first 100 cross-ecosystem agents that qualify (3 paid x402 calls in 30 days). Tiers: 10 × $5 Gold, 30 × $3 Silver, 60 × $1 Bronze. Total budget cap $200.

Five files touched in src/:

File	Change	Purpose
services/outbound-guard.js	refactor (356 lines)	per-route SHOD state
services/prospector.js	new (420 lines)	slot allocator + claim flow + leaderboard
routes/prospector.js	new (168 lines)	Express mount
services/db.js	DDL + MIGRATIONS edits	prospector_claims + prospector_admits
server.js	require + mount + capability	wire-up

Key design points

• PUBLIC mount at /v1/bank/prospector — no authMiddleware because qualification_token (HMAC, qualifier-issued) + spectral-zk-ticket (Ed25519, HiveTrust-signed) are the auth substrate. Same pattern as the public referral leaderboard/card mounts (server.js:489-509).
• /admit is internal-only via requireInternal (checks x-hive-internal header against getInternalKey()), called by the new hive-prospector-qualifier service when a DID/address pair clears the 3-paid-calls gate.
• Per-route guard state — outbound-guard now holds independent L1 allowlist / L2 daily cap / L3 per-recipient cap / L4 spectral ring / L5 trust min state per route. Default route ('default') behaviour is preserved bit-for-bit; existing callers see no change.
• Claim flow uses real sendUSDC(toAddress, amountUsdc, {reason, hive_did, route:'prospector', spectralTicket, memo}). No mocks, no simulation. Status mapping matches guard return codes: pending|paid|deferred|blocked|rejected.

Treasury math

Treasury $342.49 → cap $200 → worst-case remaining $142.49 → $50 rebalancer floor → $92.49 headroom. No refill required.

Companion PRs

• srotzin/hive-gamification#2 — bare GET /v1/rebates proxy that backs the Prospector page
• srotzin/hive-prospector-qualifier — new standalone Render service (push incoming next)
• srotzin/hive-pheromones — gradient HTML update (cosmetic, separate repo)

Env vars (Steve sets on Render dashboard)

PROSPECTOR_ENABLED=true
PROSPECTOR_QUALIFIER_SECRET=<HMAC, shared with qualifier service>
PROSPECTOR_QUALIFIER_DID=did:hive:prospector-qualifier-001
PROSPECTOR_MIN_PAID_CALLS=3
PROSPECTOR_DAILY_CAP_USD=50
PROSPECTOR_PER_RECIPIENT_CAP=5
PROSPECTOR_TRUST_MIN_TIER=VOID
PROSPECTOR_SPECTRAL_BLOCK_FROM=HIGH_VIOLET
PROSPECTOR_WINDOW_DAYS=30

Tests

• node --check clean on all 5 touched files
• 13-assertion crypto round-trip suite in companion qualifier repo passes (HMAC verify + Ed25519 sign/verify + tamper detection)
• Verified registerRoute / addToAllowlist / checkOutbound per-route paths against the existing default route's behavior — no regressions

Standing rules respected

• 'rails have to work, not mock or simulated, EVER' — claim flow uses real sendUSDC → outboundGuard
• NEED + YIELD + CLEAN-MONEY — all three gates enforced by per-route SHOD state
• No HASHRATE / GAS / GPU-PERP / energy futures
• No partner repos touched. Hivemorph remains private. Smithery permanently dropped.

Smoke test (post-deploy, single $1 payout)

1. Deploy this PR + qualifier service.
2. Pick a real cross-ecosystem agent that has done 3 paid x402 calls in the last 30 days.
3. POST tx hashes to qualifier /v1/qualify.
4. Qualifier admits to hivebank, returns token + ticket.
5. Agent calls /v1/bank/prospector/claim with token + ticket header.
6. Verify: $1 USDC lands at agent address; prospector_claims row has status='paid'; tx_hash present; leaderboard updates.