"Cobalt and fixes" (#14) removed zeronet to take it off the snapshots page, but
it deleted the chain descriptor from app/snapshots/r2.ts as well. That also
stopped /api/snapshots serving it — ?network=zeronet has been answering
400 Unknown network — so zeronet nodes can no longer sync from a snapshot.

Restore the descriptor and make visibility a separate, explicit concern:

- NetworkConfig gains `hiddenFromUi`, set on zeronet. The data layer keeps
  serving every network; only the page filters.
- isNetworkVisibleInUi() is applied in app/snapshots/page.tsx, at the render
  boundary, so hidden networks never reach the client.
- Sample data carries zeronet again, so the dev fallback mirrors what the API
  returns and the filter is exercised locally.
- Tests cover both halves: zeronet is in NETWORK_IDS but not visible in the UI,
  and an unrecognized network defaults to visible so a future network is not
  hidden by accident.

Deployment prerequisite: BASE_ZERONET_R2_ACCESS_KEY_ID / _SECRET_ACCESS_KEY
must be set in Vercel before this merges. loadSnapshots throws if any network
fails, so an unconfigured zeronet would 502 the whole endpoint, mainnet and
sepolia included.

Nothing caught #14 dropping zeronet from /api/snapshots. The page looked right,
every test passed, and the breakage only surfaced when zeronet nodes could not
sync from a snapshot.

Adds app/snapshots/networks.contract.test.ts, asserting the API surface rather
than the rendered page: every expected network is served, hiding one from the UI
is a `hiddenFromUi` flag rather than a deletion, each network carries the config
the loader needs, and ids/buckets/env prefixes stay unique. Verified it has
teeth by replaying #14's deletion — three assertions fail with messages naming
the missing network.

It also asserts each network's R2 env prefix appears in .env.example. Because
loadSnapshots throws when any network fails, a network added without documented
credentials 502s the whole endpoint, so this catches at PR time the config half
of a failure that otherwise only shows up in production.

Runs as its own `snapshots API contract` check so it can be required in branch
protection and is legible in the PR list. NETWORK_CONFIGS is exported read-only
for the test.

The contract test already runs in the `test` job — the separate job re-ran the
same nine assertions behind a second npm ci for no added enforcement. `test` is
the gate, and a failure there names the assertion and the missing network.

Keeps the test itself; documents the invariant under `test` in the README, where
it actually runs.