docs: Ledger Live integration, contract deploy learnings, NEXT_STEPS updates

- ADD_CHAIN138_TO_LEDGER_LIVE: Ledger form done; public code review repo bis-innovations/LedgerLive; init/push commands
- CONTRACT_DEPLOYMENT_RUNBOOK: Chain 138 gas price 1 gwei, 36-addr check, TransactionMirror workaround
- CONTRACT_*: AddressMapper, MirrorManager deployed 2026-02-12; 36-address on-chain check
- NEXT_STEPS_FOR_YOU: Ledger done; steps completable now (no LAN); run-completable-tasks-from-anywhere
- MASTER_INDEX, OPERATOR_OPTIONAL, SMART_CONTRACTS_INVENTORY_SIMPLE: updates
- LEDGER_BLOCKCHAIN_INTEGRATION_COMPLETE: bis-innovations/LedgerLive reference

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/deploy-besu-node-lists-to-all.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+# Deploy canonical static-nodes.json and permissions-nodes.toml to ALL Besu nodes.
+# Source: config/besu-node-lists/ (single source of truth).
+# Ensures identical node lists on every validator, sentry, and RPC for correct permissioning.
+#
+# Usage: ./scripts/deploy-besu-node-lists-to-all.sh [--dry-run]
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+source "${PROJECT_ROOT}/config/ip-addresses.conf" 2>/dev/null || true
+
+DRY_RUN=false
+[[ "${1:-}" == "--dry-run" ]] && DRY_RUN=true
+
+STATIC="${PROJECT_ROOT}/config/besu-node-lists/static-nodes.json"
+PERMS="${PROJECT_ROOT}/config/besu-node-lists/permissions-nodes.toml"
+
+if [[ ! -f "$STATIC" ]] || [[ ! -f "$PERMS" ]]; then
+    echo "ERROR: Canonical files not found:" >&2
+    [[ ! -f "$STATIC" ]] && echo "  $STATIC" >&2
+    [[ ! -f "$PERMS" ]] && echo "  $PERMS" >&2
+    echo "See config/besu-node-lists/README.md" >&2
+    exit 1
+fi
+
+# VMID -> Proxmox host (per BESU_VMIDS_FROM_PROXMOX / list-besu-vmids-from-proxmox.sh)
+declare -A HOST_BY_VMID
+# r630-01 (192.168.11.11)
+for v in 1000 1001 1002 1500 1501 1502 2101 2500 2501 2502 2503 2504 2505; do HOST_BY_VMID[$v]="${PROXMOX_R630_01:-${PROXMOX_HOST_R630_01:-192.168.11.11}}"; done
+# r630-02 (192.168.11.12)
+for v in 2201 2303 2401; do HOST_BY_VMID[$v]="${PROXMOX_R630_02:-${PROXMOX_HOST_R630_02:-192.168.11.12}}"; done
+# ml110 (192.168.11.10)
+for v in 1003 1004 1503 1504 1505 1506 1507 1508 2102 2301 2304 2305 2306 2400 2402 2403; do HOST_BY_VMID[$v]="${PROXMOX_ML110:-${PROXMOX_HOST_ML110:-192.168.11.10}}"; done
+
+BESU_VMIDS=(1000 1001 1002 1003 1004 1500 1501 1502 1503 1504 1505 1506 1507 1508 2101 2102 2201 2301 2303 2304 2305 2306 2400 2401 2402 2403 2500 2501 2502 2503 2504 2505)
+
+echo "Deploying Besu node lists from config/besu-node-lists/ to all nodes"
+echo "  static-nodes.json      -> /etc/besu/static-nodes.json"
+echo "  permissions-nodes.toml -> /etc/besu/permissions-nodes.toml"
+echo ""
+
+# Group by host to minimize scp/ssh
+declare -A VMIDS_ON_HOST
+for vmid in "${BESU_VMIDS[@]}"; do
+    host="${HOST_BY_VMID[$vmid]:-}"
+    [[ -z "$host" ]] && continue
+    VMIDS_ON_HOST[$host]+=" $vmid"
+done
+
+for host in "${!VMIDS_ON_HOST[@]}"; do
+    vmids="${VMIDS_ON_HOST[$host]}"
+    echo "--- Host $host (VMIDs:${vmids}) ---"
+    if $DRY_RUN; then
+        echo "  [dry-run] would scp and pct push to:${vmids}"
+        continue
+    fi
+    scp -o StrictHostKeyChecking=accept-new -q "$STATIC" "$PERMS" "root@${host}:/tmp/" || { echo "  Failed to scp to $host"; continue; }
+    for vmid in $vmids; do
+        if ssh -o StrictHostKeyChecking=accept-new "root@${host}" "pct status $vmid 2>/dev/null | grep -q running" 2>/dev/null; then
+            ssh -o StrictHostKeyChecking=accept-new "root@${host}" "pct push $vmid /tmp/static-nodes.json /etc/besu/static-nodes.json && pct push $vmid /tmp/permissions-nodes.toml /etc/besu/permissions-nodes.toml && pct exec $vmid -- chown besu:besu /etc/besu/static-nodes.json /etc/besu/permissions-nodes.toml 2>/dev/null || pct exec $vmid -- chown root:root /etc/besu/static-nodes.json /etc/besu/permissions-nodes.toml 2>/dev/null" 2>/dev/null && echo "  OK VMID $vmid" || echo "  Skip/fail VMID $vmid"
+        else
+            echo "  Skip VMID $vmid (not running)"
+        fi
+    done
+    ssh -o StrictHostKeyChecking=accept-new "root@${host}" "rm -f /tmp/static-nodes.json /tmp/permissions-nodes.toml" 2>/dev/null || true
+done
+
+echo ""
+echo "Done. To reload static-nodes.json and permissions-nodes.toml immediately, run:"
+echo "  bash scripts/besu/restart-besu-reload-node-lists.sh"