Delete dead code, adjust misleading errors, and remove panic-on-input

[emlautarom1]

Dead code (zero constructions / zero callers)

• DepositError::{InvalidAddress, CryptoError, HashTreeRootError, InvalidData} (L10/L58/L62/L71) — definitions only.
• KeystoreError::{UnsupportedKdf, Crypto, HexDecode} (L88/L92/L107) — no explicit construction and no ?-conversion reaches the #[from] variants (every hex/crypto failure in the module is map_err'd elsewhere).
• HexBytes::len — zero callers and the module is private.
• RelayP2PError::FailedToParseMultiaddr — the crate's multiaddr-producing calls yield P2PConfigError, so the #[from] never fires.
• ssz encode_bool/encode_u8 and decode_bool/decode_fixed_bytes — zero external references (decode_u8 is used only by decode_bool and goes with it); the u32/u64 siblings are heavily used, so the modules stay.
• obolapi client _req_timeout — assigned, never read; the timeout is baked into the reqwest builder.
• tracing config.metrics — write-only state with two redundant setters; init.rs#L66 installs MetricsLayer unconditionally (examples/basic.rs calls the no-op setter). Honor the flag or delete field + setters.
• dkg signing.rs#L244 #[allow(dead_code, reason = "will be used in dkg later")] is stale — the fn is called from run_ceremony.

Misleading errors and wrong identities

• ssz from_0x_hex_str reports a decoded byte-length mismatch as hex InvalidStringLength — a parse error identity for a length condition.
• eth2util epoch_from_slot maps a slots_per_epoch == 0 division failure to FetchSlotsPerEpoch — after the fetch already succeeded.
• deposit errors render Gwei constants as ETH: errors.rs#L18/L39 produce "must be >= 1000000000 ETH" (MIN_DEPOSIT_AMOUNT is Gwei).
• enr FailedToVerifySignature reads "Signature verification succeeded, but the signature is invalid" — internally contradictory.
• cluster definition.rs formats serde conversion errors with {:?} instead of {} (six sites, L130–L184).
• eip712 keccak_hash returns Result but is infallible; four call sites ? a never-Err.
• Two wrong comments in consensus/core: the timer's negative-round guard (timer.rs#L398-L405) is an unreachable-in-practice divergence from Go's immediate-fire with no comment acknowledging it — add the note (or drop the guard); and analysis.rs#L284-L290 describes a missing cancellation tier that is actually dead code in Go (tracker.go re-assigns the initial value), so the behavior already matches — fix the comment.

Panic on bad or edge input

• cli format_enr: the guard is byte-length <= 17, so an 18+-byte ENR containing multi-byte UTF-8 reaches from_utf8(&bytes[..13]).expect("ENR must be ASCII") or the tail slice mid-codepoint and panics; reached from config-supplied ENR strings. Use char-boundary-safe slicing.
• p2p backup_priv_key panic!s on a pre-existing backup directory and .expect()s a parent-exists invariant — effectively unreachable (the path embeds a timestamp + random nonce) but they are unhandled panics in a Result-returning function; return K1Error.
• frost evaluate_polynomial .expect()s non-empty coefficients — internal callers are guarded by validate_num_of_signers, but the fn is re-exported pub API; make the contract explicit (typed error or documented invariant).
• The eth2api new()/Default constructor that parses the literal "{server_url}" placeholder (guaranteed panic, zero callers) lives in a generated, gitignored file — it belongs to the client replacement (replace the oas3-gen generated eth2 client with a tailor-made one #611).

Idioms

• Bare casts where the crates otherwise use checked/From conversions: sigagg.rs#L177/L195 (len as u64) < self.threshold; sweep siblings in core/cluster/dkg/frost.
• priority Arc<Box<dyn Fn>> double-box (component.rs#L77 + prioritiser.rs#L100, self-acknowledged at L180) → Arc<dyn Fn>.
• or_insert_with(Vec::new/HashMap::new) → or_default (parsigdb/memory.rs#L366/L371, exchanger.rs#L300).
• k1util sign copies the already-length-checked hash into a [u8; 32] for an API that takes &[u8] (k1util.rs#L101-L107).

Acceptance

The dead items are deleted (cargo build --all-features + full test suite green); error messages carry the right identity and units; no panic!/expect reachable from config or peer input in the listed sites; the idiom sweep changes no behavior.