Add optional secondary DATUM pool failover

[innerhat-dev]

Summary

• The gateway can use a second DATUM pool when the primary connection fails. It stays with the pool that is connected, and tries the other pool only after that connection fails. An empty secondary host disables this.
• A server migration still takes over for one connection, then the gateway returns to the pool it had selected. Closing the connection for that migration does not switch pools.
• The status page shows Primary Host and Secondary Host. While the secondary pool is connected, the status dot is yellow and the text includes "secondary pool active". The pool tag and pubkey follow the connected pool. Accepted and rejected share totals carry across the switch. They reset only when the process restarts.
• The config file and the config page take a secondary host, port, and pubkey. Changing them requires a restart. Turning reward sharing off does not clear those fields.

Primary pool connected:

Secondary pool connected:

Test plan

• With no secondary host, the gateway connects only to the primary pool
• A secondary host with a bad port or pubkey is rejected
• Blocking the primary connection fails over to the secondary pool without a restart, and the share totals remain
• The status dot is green on the primary pool and yellow on the secondary pool
• Primary Host and Secondary Host stay on the configured values while the tag and pubkey follow the live pool
• An accepted migration does not leave the gateway on the other configured pool
• ./build/datum_gateway --test passes