docs: explain validator firewall allowlist

[decofe]

The validator docs never say where a firewall's validator IP list should come from. The natural guess, ValidatorConfigV2.getActiveValidators(), returns the configured registry, not the committee consensus is using. Deactivated validators stay in the committee until a DKG ceremony removes them, and a failed DKG round keeps the previous committee in place, so a registry-only allowlist can block peers the node still needs.

This adds:

• A Configure your firewall section to the validator setup guide. It tells operators to build the consensus P2P allowlist from tempo consensus info, which lists the DKG committee plus the active registry (the same peer set the node's peer manager tracks), and to refresh it continuously, since IP updates, new registrations, and identity rotations can land in any finalized block.
• A How do I configure my firewall? entry to the validator troubleshooting and FAQ page with the same guidance, linking to the setup section and the topology firewall policy.

Validation: pnpm check:types passes.

Prompted by: @SuperFluffy

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
tempo-docs	Ready	Preview	Oct 1, 2026 3:02pm UTC