[nicolasriverocorvalan]

Summary

• cTRNG is now off by default. Deployments that serve KMS only no longer run the masterseed plugin, so the gateway must start without it: ORBITPORT_MASTERSEED_PLUGIN became optional and is only required when ORBITPORT_CTRNG_ENABLED=true

• with the flag off, /api/v1/services/* is not registered (404 before auth, no credit hold) and ctrng.Get returns "cTRNG feature disabled". No cTRNG code is removed

• also reorders the RPC route to match path before method, so an unknown path answers 404 instead of the 405 warp returns when the method filter rejects first

• both compose stacks set the flag to true, so local dev and the Go beacon e2e tests are unchanged

Validation

• cargo fmt -- --check
• cargo clippy --all-targets -- -D warnings
• cargo test -- --skip test_e2e
• docker compose config on both compose files
• deployed to dev as v0.2.20-rc-2:
  1. gateway starts with ctrng_enabled: false, masterseed_plugin: None and waits only on auth, kms, account and patissuer;
  2. /api/v1/services/trng 404; GET /api/v1/rpc 405; ctrng.Get returns "cTRNG feature disabled";
  3. kms.GetCapabilities and a key-store Put/Get/Delete round trip behave normally