alpha3: race-free apply path + account_authority correctness

Fixes the two known-issues from alpha2's commit message:

- gossip + sync apply-loop race: gossip's apply goroutine deleted; sync
  owns the SINGLE apply path. Re-broadcast happens via
  sync.Config.OnBlockApplied -> gossip.BroadcastAppliedBlock (fires
  inside sync's applyLoop, same goroutine that committed the block).
- chain.Database.ApplyBlock now under applyMu (RWMutex). Read accessors
  HeadBlock/HeadBlockID/ScheduledWitness/GetDGPO take RLock so the
  witness loop can poll them without racing the applier. Witness reads
  dgpo via p.Chain.GetDGPO() instead of state.NewSession(p.State).
- fcraw.InternString locked with sync.RWMutex (the original comment
  said this was needed for production, and Phase 2 made it true).

Sig recovery:
- pow_apply now creates account_authority alongside Account (mirrors
  hived's hive_evaluator.cpp:424-430 / :561-567). Without this, every
  Transfer signed by an early-mainnet PoW-registered account fails
  verify_authority on the live-sync path.
- Genesis seeds the legacy 'steem' system account's authority with
  HIVE_STEEM_PUBLIC_KEY_STR (was empty). Mirrors database_init.cpp
  :276-291.

Result: ghive-sync against real mainnet seeds clears past block
906,000 byte-identical to the local block_log. Block 906,012 trips
the pre-existing iter15-era witness-schedule cascade — orthogonal to
this work.

Replay regression: 0 errors @ 50K+ bps. All p2p + chain + witness +
fcraw test suites green under go test -race. Testnet smoke (3-node)
converges with zero race-detector firings (pre-fix: node-1 died with
10 race reports).

8 commits since alpha2.