feat: support split L2 HTTP and WebSocket RPC

[davidtaikocha]

🧩 What was the bug?

Catalyst currently uses L2_RPC_URL for both ordinary execution-layer JSON-RPC requests and the chain monitor block subscription. Because eth_subscribe requires WebSocket, this forces ordinary request providers onto the same WebSocket transport. After that WebSocket backend exhausts its reconnect budget, ordinary requests can remain unavailable until Catalyst rebuilds the node/provider.

Related rollout work:

• chore(taiko-client,taiko-client-rs): refuse shutdown ahead of imminent sequencing windows taikoxyz/taiko-mono#22000
• https://github.com/taikoxyz/k8s-configs/pull/1461

---

🔧 What has been fixed?

• Add optional L2_WS_RPC_URL for the L2 block subscription.
• Keep L2_RPC_URL for ordinary L2 execution-layer requests, allowing those providers to use HTTP.
• Preserve backward compatibility: when L2_RPC_URL is already ws:// or wss://, Catalyst reuses it if L2_WS_RPC_URL is unset.
• Fail during configuration loading when HTTP(S) L2_RPC_URL has no WebSocket subscription URL, or when explicit L2_WS_RPC_URL is not WS/WSS.
• Route Shasta and Realtime chain monitors through l2_ws_rpc_url; Pacaya and all execution-layer providers remain on l2_rpc_url.

Example split configuration:

L2_RPC_URL=http://execution-client:8545
L2_WS_RPC_URL=ws://execution-client:8546
L2_AUTH_RPC_URL=http://execution-client:8551

---

💬 Anything else reviewers should know?

This change does not remove the WebSocket subscription or change its reconnect policy. Deployment configuration must provide L2_WS_RPC_URL before switching L2_RPC_URL to HTTP.

Validation completed locally:

• cargo test --workspace --verbose
• cargo test -p common config::tests -- --nocapture
• cargo check -p shasta -p realtime -p pacaya
• cargo sort --workspace --check
• cargo fmt --all -- --check
• typos
• cargo clippy --all-features -- -D warnings

cargo deny check also ran with the CI version of cargo-deny. It reports existing advisories in the unchanged Cargo.lock (anyhow, crossbeam-epoch, ruint, and yanked spin); this PR does not modify dependencies.

---

✅ Checklist

• Confirmed the full restart/ejection scenario no longer occurs
• Existing tests pass
• Added new tests for the configuration split
• The branch with the bugfix is named bugfix/<name>