feat: tag orders with their source (mempool vs RPC)

[MavenRain]

What

Adds a first-class OrderSource (Mempool | RpcServer | Unknown) recorded on
every order's Metadata, so the building algorithm can distinguish orders that
came from the public mempool from orders submitted directly to the builder's RPC
server. Closes #122.

Why

The build algorithm relies on this distinction, but today it is only inferable
indirectly — from the Order::Tx vs Order::Bundle shape (which mislabels raw
txs submitted via eth_sendRawTransaction, since those are also Order::Tx) and
from the out-of-band MempoolTxsDetector hash set. This makes the origin a
stored, O(1), always-correct property of the order itself.

How

• OrderSource + Metadata.source (default Unknown), with Order::source()
  and Order::set_source(). Metadata is excluded from Order equality and
  hashing (existing derivative ignores), so the tag never changes order
  identity or dedup.
• Stamp at ingress: Mempool at both mempool paths (the IPC/WS txpool fetcher
  and the reth-embedded pool path) and RpcServer in the send_order funnel.
• Not carried over the wire (a remote submitter must not be able to assert
  Mempool); backtest/test-reconstructed orders remain Unknown.

This is additive and does not change block-building behavior. The stored source
can later replace the MempoolTxsDetector lookup where a per-order (rather than
per-child-tx) granularity is sufficient — left as a follow-up per the issue's
"To Be Discussed".

Testing

• New unit tests in rbuilder-primitives: default is Unknown; set_source
  round-trips; tagging both Tx and Bundle orders updates source() without
  changing id(), Eq, or Hash.
• Extended the txpool fetcher integration test to assert a mempool-received order
  reports OrderSource::Mempool.
• cargo fmt, cargo clippy --all-targets -- -D warnings, and the primitives
  lib tests pass.