Signing Key Betrayal: How Gravity Bridge Lost $5.4M in One Hour and What It Means for Cross-Chain Security