feat(settlement): wire real Chain 138 contracts for 1,000 BTC ledger

Add canonical btc-l1-ledger config, /btc/contracts API, Python chain138-oracle
service, and production deploy scripts so secure.omdnl.org can serve live cBTC,
DODO, and PMM pool addresses with headroom-aware mint gating.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/integration/ORACLE_AND_KEEPER_CHAIN138.md

@@ -34,14 +34,15 @@ References: [DEPLOYMENT_COMPLETE_GUIDE.md](../deployment/DEPLOYMENT_COMPLETE_GUI
 
 3. **Oracle publisher (off-chain)**  
    Service that pushes external prices (e.g. CoinGecko) into the system:  
-   - `services/oracle-publisher/` (e.g. `oracle_publisher.py`, `oracle_publisher_optimized.py`).  
+   - **`services/chain138-oracle/`** (Python) — unified stack: MetaMask spot API, FX refresh, PMM liquidity, on-chain aggregator push, keeper mesh. See `services/chain138-oracle/README.md`.  
+   - Legacy: `services/oracle-publisher/` (external VM), `scripts/update-oracle-price.sh`, `scripts/reserve/keeper-service.js`.  
    Use for assets that do not have a Chainlink-style aggregator on Chain 138.
 
 4. **Update oracle price script**  
    One-off or cron-driven update of oracle/oracle proxy with current price:  
-   - `scripts/update-oracle-price.sh` — usage: `[rpc-url] [oracle-address] [private-key]`; uses `AGGREGATOR_ADDRESS` and fetches ETH/USD from CoinGecko.  
+   - **`python -m chain138_oracle update-oracle`** (Python) or legacy `scripts/update-oracle-price.sh`  
    **CoinGecko Demo keys** (`CG-…`): use `https://api.coingecko.com` with header `x-cg-demo-api-key` (not `pro-api.coingecko.com` with `x-cg-pro-api-key`). Paid Pro uses the pro host and pro header; the script tries demo first, then pro, then unauthenticated public.  
-   Schedule this (or the keeper service) so PMM oracle-backed prices and reporting stay fresh.
+   Schedule **`chain138-oracle-mesh`** (systemd) or `python -m chain138_oracle mesh` so PMM oracle-backed prices and reporting stay fresh.
 
 ---
 
@@ -64,7 +65,7 @@ References: [DEPLOYMENT_COMPLETE_GUIDE.md](../deployment/DEPLOYMENT_COMPLETE_GUI
 By default it writes the secret to `~/.secure-secrets/chain138-keeper.env` and a local helper
 to `.env.keeper.local` (gitignored) that sources the secret file.
 
-**systemd:** `config/systemd/chain138-pmm-mesh-automation.service.example` in the Proxmox repo—copy, fix paths, `enable --now`.
+**systemd:** `services/chain138-oracle/systemd/chain138-oracle-mesh.service.example` — copy via `scripts/deployment/cutover-chain138-oracle-python.sh`, or manually fix paths and `enable --now`.
 
 **Bring-up checklist (operator):**
 1. `PRICE_FEED_KEEPER_ADDRESS` in `smom-dbis-138/.env` (Chain 138: `0xD3AD6831aacB5386B8A25BB8D8176a6C8a026f04` per explorer docs—verify live).