Guard stake RPC operator public key

[giwaov]

Summary

• Preserve an explicitly supplied stake pubKey instead of always replacing it with the signer key.
• Reject stake RPC requests when the supplied public key does not resolve to the requested validator address.
• Add focused RPC admin tests for pubKey preservation and validator-address validation.

Why

Fixes #203. Signing a stake request with the output key should not silently construct a custodial validator registration for the output key.

Testing

• git diff --check
• Not run: Go toolchain is not installed in this environment.