FIX-06: extend multi-TSA redundancy to offline/deferred captures

[ChelseaKR]

Deferred/queued captures and archive re-timestamping now get the same
multiple-authority redundancy as online capture (item R-16), so the most
at-risk items — taken with no signal — no longer rest on a single TSA.

• capture.resolve_deferred(vault, tsa, extra_tsas=()): after fetching the
  primary token for a queued item, also stamp the digest against every
  configured redundant authority via _stamp_additional, and surface the
  succeeded authorities on CaptureResult.extra_authorities. Unreachable
  extras are skipped, exactly as on the online path.
• capture.retimestamp_all(vault, tsa, extra_tsas=()): each redundant
  authority threads a further link over the previous one into the archive
  chain (via new _archive_against_extras), recorded in custody with
  details role "additional". Threading (rather than storing independent
  archives of the additional tokens) keeps the chain strictly linear, which
  verify_archive_chain requires, so exported packets still verify cleanly.
  An unreachable extra is skipped and never fails the pass.
• cli: resolve and retimestamp pass extra_tsas=_extra_tsas_for(...), and
  the app command threads the same extras into make_app_server.
• appserver: AppServer gains an extra_tsas field and /api/resolve stamps
  queued captures against them.
• vault.py is untouched: authorities are resolved from config at stamp
  time (like the online path), so the deferred queue need not persist them.

Tests: test_vault_capture covers an offline capture resolving with >=2
authorities and an unreachable extra being skipped; test_archive covers the
threaded archive chain still verifying in a packet. Marks FIX-06 done in
docs/ideation/02-large-scale-fixes.md.

Co-Authored-By: Claude Fable 5 noreply@anthropic.com

---

Backfill PR for a completed roadmap item (roadmap/fix-06-extend-multi-tsa-redundancy-to-of, 1 commit(s) over main). Part of the portfolio roadmap batch.