feat(worker): add proxy routes for Beacon API, Bitcoin RPC and EVM RPC

[AugustoL]

Description

Add per-provider proxy routes to the OpenScan worker to hide API keys for multiple RPC providers. This enables built-in fallback RPC endpoints for all supported networks without exposing API keys to users.

Providers: Alchemy, Infura, dRPC, Ankr, OnFinality

Related Issue

Closes #334

Type of Change

• Bug fix
• New feature
• Documentation update
• Refactoring
• Performance improvement
• Other (please describe):

Changes Made

Worker (15 new files + 4 modified)

• Types (worker/src/types.ts): Added env bindings for ALCHEMY_API_KEY, INFURA_API_KEY, DRPC_API_KEY, ONFINALITY_BTC_API_KEY, ANKR_API_KEY. Added ALLOWED_BEACON_NETWORKS, ALLOWED_BTC_METHODS, ALLOWED_EVM_NETWORKS maps with per-provider chain slugs, and request body types
• Rate limiting: 3 new middleware files — Beacon (60 req/min), BTC (30 req/min), EVM (60 req/min)
• Validation: 3 new middleware files — Beacon (networkId + slot), BTC (JSON-RPC + method allowlist), EVM (networkId + JSON-RPC body)
• Route handlers: 6 new files — beaconBlobSidecars.ts, btcRpc.ts, evmRpc.ts, drpcRpc.ts, ankrRpc.ts, onfinalityRpc.ts
• Router (worker/src/index.ts): Registered all new routes
• CORS (worker/src/middleware/cors.ts): Added GET to allowed methods
• Config (worker/wrangler.toml): Renamed worker to openscan-worker-proxy, documented all new secrets

Routes

Method	Path	Provider	Networks
GET	/beacon/alchemy/:networkId/blob_sidecars/:slot	Alchemy	ETH, Sepolia
POST	/btc/alchemy	Alchemy	BTC mainnet
POST	/btc/drpc	dRPC	BTC mainnet
POST	/btc/ankr	Ankr	BTC mainnet
POST	/btc/onfinality/:networkId	OnFinality	BTC mainnet + testnet
POST	/evm/alchemy/:networkId	Alchemy	All 8 EVM networks
POST	/evm/infura/:networkId	Infura	7 EVM networks (no BSC)
POST	/evm/drpc/:networkId	dRPC	All 8 EVM networks
POST	/evm/ankr/:networkId	Ankr	All 8 EVM networks

Frontend (3 new files + 4 modified)

• src/config/workerConfig.ts (new): Shared OPENSCAN_WORKER_URL constant, updated to new worker URL
• src/services/BeaconService.ts (new): getBlobSidecarsViaWorker() for fetching blob sidecars via worker
• src/hooks/useBeaconBlobs.ts (new): React hook for beacon blob data
• src/utils/rpcStorage.ts: Added worker URLs to BUILTIN_RPC_DEFAULTS for all supported networks (BTC + EVM, all providers)
• src/components/pages/settings/index.tsx: Worker-proxied URLs labeled as "OpenScan Alchemy/Infura/dRPC/Ankr/OnFinality" with rpc-opensource tag
• src/hooks/useEtherscan.ts + src/utils/contractLookup.ts: Refactored to import from workerConfig.ts

Screenshots (if applicable)

N/A — backend/infra changes

Checklist

• I have run npm run format:fix and npm run lint:fix
• I have run npm run typecheck with no errors
• I have run tests with npm run test:run
• I have tested my changes locally
• I have updated documentation if needed
• My code follows the project's architecture patterns

Additional Notes

• Worker renamed from openscan-groq-ai-proxy to openscan-worker-proxy — old worker remains live until frontend is deployed
• All routes deployed and tested successfully via curl
• All secrets set via wrangler secret put: ALCHEMY_API_KEY, INFURA_API_KEY, DRPC_API_KEY, ANKR_API_KEY, ONFINALITY_BTC_API_KEY
• BTC Alchemy uses bitcoin-mainnet.g.alchemy.com (not the deprecated alchemy-blast.com)
• This PR should be merged after PRs feat(blocks/tx): Display raw blob data content via Beacon API #332 and fix: invalidate metadata cache on version bump #333

[github-actions]

🚀 Preview: https://pr-335--openscan.netlify.app
📝 Commit: 6445aadd3a88215c9cd0ffdbe5de021900d020a8

[josealoha666]

Nice direction overall, but I don't think this is ready to merge yet.

The main issue is that the new /evm/* proxy exposes a shared-key JSON-RPC gateway with no EVM method allowlist at all. validateEvmMiddleware only checks that method is a non-empty string, so any public caller can send arbitrary methods through our Alchemy/Infura/dRPC/Ankr keys. That makes the worker much easier to abuse for expensive or unintended calls than the BTC routes, which at least have an explicit allowlist.

Before merging, I'd lock the EVM proxy down to the subset of read-only methods the app actually needs (and ideally add payload/range guards for expensive methods like log scans).

Also worth keeping an eye on the red E2E jobs before landing this.