feat: Add RPC certificate pinning support

[p70436464-prog]

Closes #421

Description

This PR introduces TLS certificate pinning for the RPC client as defense-in-depth against DNS hijacking or compromised CAs. It adds an optional rpcCertificateFingerprint field to the configuration, which is especially useful for teams pointing sorokeep against private or elevated-trust mainnet-adjacent RPC endpoints.

Changes

• Added rpcCertificateFingerprint option to ~/.sorokeep/config.yaml (src/utils/config.ts).
• Configured StellarRpcClient to inject an undici.Agent containing a custom checkServerIdentity TLS verification step into the fetch dispatcher when the fingerprint is configured.
• Added documentation to docs/config-reference.md explaining how users can get their fingerprint via openssl.
• Added TDD unit tests to tests/rpc/client.test.ts for the custom fetch integration and constructor config parsing.

By default (with no pinned fingerprint), the connection behavior and standard TLS validation remain unchanged.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: 14affcd3-bd69-4234-b24f-83593df24e90

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}