fix: vercel rewrites for new EIP + add mainnet proxy

[owenwahlgren]

Summary

• Default `FIRN_BOX` to `44.195.57.61` (new EIP).
• Rename rewrite path `/api/firn/fuji` → `/api/firn/testnet` so it matches the public env-var convention (`NEXT_PUBLIC_FIRN_TESTNET`).
• Add `/api/firn/mainnet` → `https://grotto..sslip.io` so the Vercel HTTPS frontend can reach Grotto via Caddy without mixed-content blocks.

After merge — Vercel env vars to set

• `FIRN_BOX_HOST=44.195.57.61` (optional; this is now the default)
• `NEXT_PUBLIC_FIRN_LOCAL=/api/firn/local`
• `NEXT_PUBLIC_FIRN_TESTNET=/api/firn/testnet`
• `NEXT_PUBLIC_FIRN_MAINNET=/api/firn/mainnet`

Then redeploy. The frontend will hit same-origin `/api/firn/*` paths and Vercel's edge will proxy server-side to the firn instances.

Test plan

• `tsc --noEmit` clean (pre-existing `.next/dev/types` errors are unrelated)
• `prettier --check` clean