fix(telemetry): stop the mainnet node colliding with devnet and drop signing

The mainnet and devnet telemetry configs are host processes sharing one
network namespace and working directory, and they agreed on every port and
both database paths. Running them together left the second unable to bind,
and running them in sequence pointed a mainnet node at a store holding the
other network's ledgers, silently and with no error.

Offset the mainnet ports by ten and name both database paths after the
network, matching what debug_logfile already did.

Also narrow the attack surface this config carried. [port_ws_public] has
no admin key, so every caller on it is a guest, and it was bound to all
interfaces on a node following Mainnet; it is now loopback, and nothing in
the repo connects to that port. [signing_support] is removed: it only
affects non-admin callers, the admin ports already grant signing to local
callers, and upstream deprecates the commands it exposes. Verified against
a running node: signing still succeeds on the admin port and is refused as
notSupported on the public one.

docker/telemetry/xrpld-telemetry-mainnet.cfg

@@ -11,11 +11,15 @@
 #   2. Run xrpld:
 #        ./xrpld --conf docker/telemetry/xrpld-telemetry-mainnet.cfg
 #   3. Wait for sync (server_state=full), then exercise workflows:
-#        curl -s http://localhost:5005 -d '{"method":"server_info"}'
+#        curl -s http://localhost:5015 -d '{"method":"server_info"}'
 #   4. View traces in Grafana Explore -> Tempo: http://localhost:3000
 
 # --- Server ports -----------------------------------------------------------
 
+# Ports are offset by +10 from the devnet config (xrpld-telemetry.cfg) so both
+# nodes can run at the same time. They are host processes sharing one network
+# namespace, so identical ports would leave the second node unable to bind.
+
 [server]
 port_rpc_admin_local
 port_ws_admin_local
@@ -23,24 +27,30 @@ port_ws_public
 port_peer
 
 [port_rpc_admin_local]
-port = 5005
+port = 5015
 ip = 127.0.0.1
 admin = 127.0.0.1
 protocol = http
 
 [port_ws_admin_local]
-port = 6006
+port = 6016
 ip = 127.0.0.1
 admin = 127.0.0.1
 protocol = ws
 
+# Bound to loopback: this port has no `admin` key, so every caller resolves to
+# Role::GUEST. Every workflow documented for this config is driven over the two
+# admin ports above, which also serve WebSocket, and this node follows Mainnet, so
+# there is no reason to accept off-host clients.
 [port_ws_public]
-port = 6005
-ip = 0.0.0.0
+port = 6015
+ip = 127.0.0.1
 protocol = ws
 
+# Stays on all interfaces: this is the peer-protocol listener, and binding it to
+# loopback would stop inbound overlay connections.
 [port_peer]
-port = 51235
+port = 51245
 ip = 0.0.0.0
 protocol = peer
 
@@ -73,21 +83,29 @@ validators-mainnet.txt
 [path_search_max]
 10
 
-# --- Signing (allows sign/sign_for RPC for test tx submission) --------------
+# --- Signing ----------------------------------------------------------------
 
-[signing_support]
-true
+# [signing_support] is deliberately omitted (it defaults to false). It is only
+# consulted for non-admin callers, and every signing path in this repo already
+# runs as admin over the loopback admin ports above, so enabling it would add
+# nothing except exposing sign/sign_for/channel_authorize to guests on a node
+# that follows Mainnet. Upstream also deprecates these commands.
 
 # --- Database ---------------------------------------------------------------
 
+# Paths carry the network name so this node never shares a store with the devnet
+# config. Both are relative to the working directory (the repo root, per the
+# usage note above), so an unqualified `data/` would have the two nodes opening
+# the same NuDB and the same SQLite ledger databases — including the case where
+# they run one after the other rather than concurrently.
 [node_db]
 type=NuDB
-path=docker/telemetry/data/nudb
+path=docker/telemetry/data/mainnet/nudb
 online_delete=2000
 advisory_delete=0
 
 [database_path]
-docker/telemetry/data
+docker/telemetry/data/mainnet
 
 [ledger_history]
 1000