feat(model): derive provider bandwidth from settled contract bytes

[Ryanmello07]

Passive bandwidth signal from already-settled contract_close bytes: zero additional bandwidth cost and it cannot be gamed selectively, since a provider cannot inflate real user traffic without actually being fast for real users. Advisory only -- nothing in this PR gates provider selection, scoring, or PassesMinimums.

ComputePassiveProviderBandwidth(ctx, clientId, window) sums contract_close.used_transfer_byte_count for contracts where the provider is the destination and party = 'destination', divided by the wall-clock span max(close_time) - min(create_time) across the matched rows. Returns nil rather than zero when the provider settled no bytes in the window (no history is not measured-zero throughput), and nil rather than dividing by a non-positive span.

companion_contract_id IS NULL is the load-bearing clause: a client's return traffic settles as a contract where the CLIENT is the destination, so without the exclusion an ordinary user reads as a very fast provider. Verified against a live deployment: for contracts created in the last day, companion-leg destinations are never provide_mode = 3 (Public) while primary-leg destinations are. Teeth-checked by deleting the clause -- the companion test then reports 67108864 bytes/sec for a client that never provided.

No schema change and no new caller in this PR; storage and consumers follow.

Tests: 3 new tests in model (derives-from-settled-bytes, nil-when-no-history, excludes-companion-contracts), all passing against a local Postgres/Redis stack with -count=1. go build ./... and go vet ./... clean, gofmt clean on both new files. Cherry-picked onto main with zero conflicts.

[Ryanmello07]

Superseded by #425, which consolidates this stack into a single branch rebased onto current main. The work is unchanged and included there — this PR's commits are in #425's history (or, where the chain rewrote them, their final form is). Closing to keep review in one place.