…nstant (#103)

## Summary

Follow-up to #101 — fixes the harnesses that were missed because they
live next to (but aren't) the runners that the first PR touched:

- **`lifecycle/ci-test.ts`** is what the lifecycle Docker compose
actually invokes (`lifecycle/main.ts` is local-only). Now wires
`ppPublicKey` on Config and registers Alice/Bob via /api/v1/entities
before deposit/send. This is what unblocks **provider-platform's**
lifecycle CI.
- **`e2e/governance/uc2-approve-reject.ts`** still read
`.councilMembership` (singular) on the dashboard /pp/list response;
provider-platform PR #103 had renamed it to `.councilMemberships`
(plural array) months ago. Updated reads to `[0]?.status` / `.length ===
0`.
- **`e2e/pos-instant/main.ts`** registers `keys.payService` as APPROVED
before the instant payment flow, since pay-platform authenticates to
provider-platform under that key and otherwise trips the
SUBMITTER_NOT_APPROVED gate.
- **`test/setup-e2e.ts`** writes `E2E_PP_PUBLIC_KEY` to
/config/contracts.env. (`e2e/setup.sh` already had this in the CI flow;
the local `./test.sh e2e` flow uses the test/ setup script and needs the
same line.)

## Test plan

Locally (`./test.sh all`), all 5 suites green: e2e, otel, governance,
lifecycle, pos-instant.

After this merges, re-running provider-platform's PR CI
(Moonlight-Protocol/provider-platform#106)
should flip lifecycle from red to green.

)

## Summary

Three bundled changes for the provider-dashboard work:

1. **`feat(entities)`** — rename `users` → `entities`, add POST
/api/v1/entities for KYC/KYB-style approval, gate bundle submission on
the submitter's entity being APPROVED (`SUBMITTER_NOT_APPROVED`).
2. **`feat(bundles)`** — bundles submitted to
`/api/v1/providers/:ppPublicKey/bundles` instead of channel-only. Each
bundle row carries `pp_public_key`. channel-resolver requires explicit
PP, returns the PP-bound signer/channel client.
`bundle.jurisdiction_from/to` dropped (now derived from the submitter's
entity). dashboard `listRecentBundles` is PP-scoped and returns
entityName / jurisdictions / aggregated amount. Event emission moves
from `emitForChannel` (every PP on the channel) to `emitForBundles` /
`emitForPp` so dashboards only see events for bundles that belong to
them.
3. **Version bump** to 0.7.0 (minor — new surface area).

Migrations: 0014 (rename users→entities), 0015 (drop bundle
jurisdictions), 0016 (bundle pp_public_key).

## CI note

Cross-repo deadlock with `local-dev` and `pay-platform`:
- This PR's e2e + lifecycle CI uses `local-dev@main` which still calls
the old `/api/v1/bundle` route — will be red until local-dev's PR
(Moonlight-Protocol/local-dev#101) merges.
- Pay-platform PR
(Moonlight-Protocol/pay-platform#35) also needs
to merge to fix the same old-URL call from production payment flow.

Locally, with all three branches checked out, `./test.sh all` is green
across e2e + otel + governance + lifecycle + pos-instant.

## Test plan

- [x] deno fmt --check (288 files)
- [x] deno lint (248 files)
- [x] deno task test:unit (64 passed)
- [x] deno task test:pay (136 passed)
- [x] Local `./test.sh all` against local-dev + pay-platform branches —
all 5 suites green