fix: bootstrap e2e tests, error-envelope coverage, API key expiry enf…

[Kinghezzy]

…orcement

Summary

Four gap fixes that were previously open:

1. Real AppModule bootstrap e2e test

• Add test/app-module-bootstrap.e2e-spec.ts
• Boots the full AppModule (no mocks) exactly as main.ts does
• Verifies DI wiring: WalletsService, KeyManagementService, ApiKeyService, ApiKeyGuard, MaintenanceGuard, RateLimitGuard, PrismaService all resolve
• Confirms public endpoints (GET /v1/health, GET /v1/ready) are reachable
• Confirms ApiKeyGuard is globally applied (401 without key)
• Confirms HttpExceptionFilter returns structured envelope on 404s
• Documents duplicate IdempotentUserModule/TracingModule imports in AppModule (NestJS deduplicates them; regression guard added)

2. Error-envelope production bootstrap test

• Add test/error-envelope-bootstrap.e2e-spec.ts
• error-handling.e2e-spec.ts manually registers HttpExceptionFilter after app init, masking the case where it is removed from main.ts bootstrap
• New test replicates the exact main.ts setup sequence and independently verifies: envelope shape, requestId echo/generation, ISO 8601 timestamp, security (no stack traces / file paths), and that the filter (not NestJS default handler) is actually doing the formatting (timestamp/path/method absent from NestJS default output)

3. README + .env.example: remove phantom env vars

• Remove JWT_SECRET (never implemented, no corresponding code)
• Replace API_KEY_EXPIRY_DAYS (wrong name, never implemented) with the correct and now-implemented API_KEY_DEFAULT_EXPIRY_DAYS
• Add API_KEY_DEFAULT_EXPIRY_DAYS= to .env.example with full doc comment

4. Implement API_KEY_DEFAULT_EXPIRY_DAYS

• src/config/env.validation.ts: add API_KEY_DEFAULT_EXPIRY_DAYS to ValidatedEnv interface and validateEnv() with optionalInt parsing, range [0, 3650], default 0 (non-expiring)
• src/api-keys/api-key.service.ts: read API_KEY_DEFAULT_EXPIRY_DAYS from ConfigService; in createApiKey(), compute expiresAt = now + N*days when the caller omits expiresAt and defaultExpiryDays > 0; explicit caller expiresAt always beats the default
• src/api-keys/api-key.service.spec.ts: five new unit tests covering: default expiry window, explicit override, zero=non-expiring, rejection after expiry, DB status flip to EXPIRED
• test/api-key-expiry.e2e-spec.ts: full e2e suite (offline, in-memory Prisma stub) covering: default expiry applied, explicit override, non-expiring (0), first rejection 401, status flip verified, second call still 401, future-dated key valid, boundary (1 ms past) rejected

Affected files

• test/app-module-bootstrap.e2e-spec.ts (new)
• test/error-envelope-bootstrap.e2e-spec.ts (new)
• test/api-key-expiry.e2e-spec.ts (new)
• src/api-keys/api-key.service.ts (modified)
• src/api-keys/api-key.service.spec.ts (modified)
• src/config/env.validation.ts (modified)
• README.md (modified)
• .env.example (modified)

closes #777
closes #778
closes #779
closes #780

[drips-wave]

@Kinghezzy Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits